CVE-2026-31589

Summary

In the Linux kernel, the following vulnerability has been resolved:

mm: call ->free_folio() directly in folio_unmap_invalidate()

We can only call filemap_free_folio() if we have a reference to (or hold a lock on) the mapping. Otherwise, we've already removed the folio from the mapping so it no longer pins the mapping and the mapping can be removed, causing a use-after-free when accessing mapping->a_ops.

Follow the same pattern as __remove_mapping() and load the free_folio function pointer before dropping the lock on the mapping. That lets us make filemap_free_folio() static as this was the only caller outside filemap.c.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxfb7d3bc4149395c1ae99029c852eab6c28fc3c88 < efc52947247a21bbf79059539bbbd40f4ea76f00affected
LinuxLinuxfb7d3bc4149395c1ae99029c852eab6c28fc3c88 < b667df39d98a7a24be7c2a40ff0863dac1ad2cd7affected
LinuxLinuxfb7d3bc4149395c1ae99029c852eab6c28fc3c88 < c330e65ea59c4805d6ab6757c4ddfe8c63acef31affected
LinuxLinuxfb7d3bc4149395c1ae99029c852eab6c28fc3c88 < 615d9bb2ccad42f9e21d837431e401db2e471195affected
LinuxLinux6.14affected
LinuxLinux0 < 6.14unaffected
LinuxLinux6.18.27 <= 6.18.*unaffected
LinuxLinux6.19.14 <= 6.19.*unaffected
LinuxLinux7.0.1 <= 7.0.*unaffected
LinuxLinux7.1 <= *unaffected

Weaknesses

References