CVE-2026-31514: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31514 is a Linux kernel vulnerability in the erofs filesystem that causes silent data corruption when IO read operations are interrupted by signals such as SIGKILL. When vfs_iocb_iter_read() is interrupted mid-operation during a file-backed mount read, unused folios in the bio (block I/O) structure are incorrectly marked as uptodate despite the read being incomplete. Affected Linux kernel versions include 6.12.x (6.12.75–6.12.79), 6.18.x (6.18.14–6.18.20), and 6.19.x (6.19.4–6.19.10). It was published on April 22, 2026, with patches released by April 28, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Github Advisory).

The root cause is improper error handling in the erofs filesystem's erofs_fileio_ki_complete() callback, which marks all folios in a bio as uptodate regardless of whether the read completed successfully. When a SIGKILL or similar signal interrupts vfs_iocb_iter_read() during a file-backed mount operation, the function returns the number of bytes actually copied rather than the full requested amount, but the completion handler does not account for this short-read condition. The call chain is: vfs_read → filemap_read → filemap_get_pages → filemap_readahead → erofs_fileio_readahead → erofs_fileio_rq_submit → vfs_iocb_iter_read, where signal detection occurs inside the nested filemap_get_pages, yet erofs_fileio_ki_complete subsequently marks all folios as successfully read. The fix sets the short-read bio with an error flag directly, preventing the incorrect uptodate marking. No CWE classification has been formally assigned (Github Advisory).

The primary impact is an availability and data integrity risk: applications using erofs file-backed mounts may silently receive corrupted or incomplete data when signal interruptions occur during read operations, without any error being surfaced to the calling application. This silent data corruption could cause applications to process partial data as if it were complete, leading to unpredictable behavior or data loss. Confidentiality and integrity of data at rest are not directly compromised by an external attacker, but system reliability is undermined. The scope is limited to systems using the erofs filesystem with file-backed mounts on affected kernel versions (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (e.g., the ability to send SIGKILL to a process performing erofs reads), making remote exploitation infeasible. The EPSS score is approximately 0.018% (3rd percentile), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

Upgrade the Linux kernel to a patched version: 6.12.80 or later (commit d1ba7d6b3cd1757b108d7b6856c92ae661d6c323), 6.18.21 or later (commit 5cf3972c8221abdb1b464a14ccf8103d840b9085), or 6.19.11 or later (commit 5a5f23ef5431639db1ac3a0b274aef3a84cc413c). An additional fix commit eade54040384f54b7fb330e4b0975c5734850b3c is also available. Organizations using erofs with file-backed mounts should prioritize patching; as a temporary workaround, avoiding erofs file-backed mounts on affected kernel versions can mitigate the risk. Amazon Linux 2023 has issued an advisory (ALAS2023-2026-1646) and Oracle Linux has also released updated UEK kernels addressing this issue (Github Advisory).