CVE-2026-31714: 
Chainguard vulnerability analysis and mitigation

CVE-2026-31714 is a memory leak vulnerability in the Linux kernel's f2fs (Flash-Friendly File System) f2fs_rename() function. The flaw was introduced by commit 40b2d55e0452 ("f2fs: fix to create selinux label during whiteout initialization"), which added a call to f2fs_setup_filename() without a corresponding call to f2fs_free_filename(), leaving allocated filename memory unreleased. It was reported by syzbot and disclosed on May 1, 2026. Affected kernel versions span multiple stable branches including 6.6.23–6.6.136, 6.7.11–6.8, 6.8.2–6.9, 6.9–6.12.84, 6.13–6.18.25, 6.19–7.0.2, and 7.1-rc1. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime). When f2fs_rename() is invoked — for example via the renameat2 syscall — it calls f2fs_setup_filename() (which internally calls fscrypt_setup_filename() and allocates memory via kmalloc) but fails to call the matching f2fs_free_filename() on certain code paths, resulting in a kernel memory leak. The vulnerability is locally exploitable with low privileges and requires no user interaction; an attacker can repeatedly trigger the leak by issuing renameat2 syscalls on an f2fs-mounted filesystem (Red Hat Bugzilla).

Successful exploitation allows a low-privileged local user to progressively exhaust kernel memory by repeatedly triggering the memory leak via renameat2 syscalls on an f2fs filesystem. The primary impact is a denial of service — the system may become unresponsive or crash as available memory is depleted. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability was discovered through automated fuzzing by syzbot. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory, Red Hat Bugzilla).

1. Precondition: Obtain a local account with low privileges on a Linux system running a vulnerable kernel version with an f2fs filesystem mounted.
2. Identify f2fs mount: Confirm an f2fs filesystem is mounted (e.g., via mount | grep f2fs or cat /proc/mounts).
3. Trigger memory leak: Write a loop that repeatedly calls the renameat2 syscall (or uses the rename()/renameat2() libc wrappers) on files within the f2fs-mounted directory. Each call causes f2fs_setup_filename() to allocate memory that is never freed.
4. Exhaust kernel memory: By running the loop continuously, kernel memory is incrementally leaked. Over time, the system's available memory is depleted, leading to OOM conditions and eventual denial of service (Red Hat Bugzilla).

• Logs: Kernel messages from kmemleak reporting unreferenced objects allocated via fscrypt_setup_filename / f2fs_setup_filename in f2fs_rename; OOM killer log entries in /var/log/kern.log or dmesg.
• System Behavior: Gradual increase in kernel memory usage (/proc/meminfo showing declining MemFree/MemAvailable) without a corresponding increase in user-space process memory; system slowdown or unresponsiveness on f2fs-mounted systems.
• Process: High-frequency renameat2 syscall activity from a low-privileged process on an f2fs filesystem, detectable via strace, auditd, or eBPF-based monitoring tools.

Patches are available in the following Linux kernel stable branches: 6.6.136+, 6.8+, 6.9+, 6.12.84+, 6.18.25+, and 7.0.2+. The fix adds the missing f2fs_free_filename() call to properly release allocated memory in f2fs_rename(). Administrators should upgrade to a patched kernel version as the primary remediation. As a temporary workaround where immediate patching is not feasible, consider restricting local user access to f2fs-mounted filesystems or monitoring kernel memory usage for signs of exhaustion (Red Hat Bugzilla, Red Hat Advisory).