CVE-2026-23224

Deeper analysis

CVE-2026-23224 is a use-after-free (UAF) vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation. It affects file-backed mounts when the directio mount option is enabled, triggering a race condition during read operations. The issue arises in the erofs_fileio path, where a bio submission returns -EIOCBQUEUED, leading to premature freeing of the erofs_fileio_rq structure in erofs_fileio_ki_complete(). Subsequent access in file_accessed() dereferences a NULL filp pointer, resulting in a kernel panic, as evidenced by the provided call trace involving z_erofs_read_folio, filemap_fault, and page fault handlers.

A local attacker with low privileges (PR:L) can exploit this vulnerability due to its low attack complexity (AC:L) and lack of user interaction requirement (UI:N). Exploitation occurs in a race between z_erofs_runqueue and the workqueue s_dio_done_wq, potentially allowing the attacker to trigger the UAF during EROFS file reads on affected mounts. Successful exploitation yields high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with a CVSS v3.1 base score of 7.8, enabling kernel crashes or more severe outcomes like arbitrary code execution or data corruption via the freed memory.

Mitigation is provided through upstream kernel patches, including commits such as 1caf50ce4af096d0280d59a31abdd85703cd995c, ae385826840a3c8e09bf38cac90adcd690716f57, b2ee5e4d5446babd23ff7beb4e636be0fb3ea5aa, and d741534302f71c511eb0bb670b92eaa7df4a0aec. These introduce a reference count in struct erofs_fileio_rq, initialized to 2, which is decremented by both erofs_fileio_ki_complete() and erofs_fileio_rq_submit(); the structure is freed only when the count reaches zero, preventing the UAF race. Security practitioners should apply these stable kernel updates to vulnerable systems using EROFS with file-backed directio mounts.