CVE-2026-31580

In the Linux kernel, the following vulnerability has been resolved: bcache: fix cached_dev.sb_bio use-after-free and crash In our production environment, we have received multiple crash reports regarding libceph, which have caught our attention: ``` [6888366.280350] Call Trace: [6888366.280452] blk_update_request+0x14e/0x370 [6888366.280561] blk_mq_end_request+0x1a/0x130 [6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd] [6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd] [6888366.280903] __complete_request+0x22/0x70 [libceph] [6888366.281032] osd_dispatch+0x15e/0xb40 [libceph] [6888366.281164] ? inet_recvmsg+0x5b/0xd0 [6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph] [6888366.281405] ceph_con_process_message+0x79/0x140 [libceph] [6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph] [6888366.281661] ceph_con_workfn+0x329/0x680 [libceph] ``` After analyzing the coredump file, we found that the address of dc->sb_bio has been freed. We know that cached_dev is only freed when it is stopped. Since sb_bio is a part of struct cached_dev, rather than an alloc every time. If the device is stopped while writing to the superblock, the released address will be accessed at endio. This patch hopes to wait for sb_write to complete in cached_dev_free. It should be noted that we analyzed the cause of the problem, then tell all details to the QWEN and adopted the modifications it made.

• CWE-416

• https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576Patch
• https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9Patch
• https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1Patch
• https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27Patch
• https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2
• https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85
• https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753Patch
• https://git.kernel.org/stable/c/f50e7c325ab1207fe941555bcff659f6d7050572
• https://git.kernel.org/stable/c/fec114a98b8735ee89c75216c45a78e28be0f128Patch

Published

Apr 24, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31575In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-31576In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31577In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-31578In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31579In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-3158IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1…4.3
• CVE-2026-31581In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31582In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31583In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31584In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-31585In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-31586In the Linux kernel, the following vulnerability has been re…7.8