CVE-2026-31598

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-31598 is a deadlock vulnerability in the Linux kernel's ocfs2 filesystem, stemming from an ABBA lock ordering violation between the orphan directory inode_lock and the ip_alloc_sem. In ocfs2_unlink, the locks are acquired in the order of orphan dir inode_lock followed by ip_alloc_sem, while ocfs2_dio_end_io_write acquires them in reverse: ip_alloc_sem first, then orphan dir inode_lock. This can lead to a deadlock when the operations execute concurrently on different CPUs, as detailed in the lock chains provided in the advisory.

A network-accessible, unauthenticated attacker with low attack complexity and no user interaction can exploit this vulnerability remotely (AV:N/AC:L/PR:N/UI:N/S:U), triggering the deadlock scenario. The attacker can cause a denial-of-service condition by inducing concurrent unlink and direct I/O end-write operations on affected ocfs2 volumes, resulting in high availability impact (C:N/I:N/A:H) with a CVSS v3.1 base score of 7.5. Successful exploitation hangs kernel processes involved, disrupting filesystem operations.

Mitigation is addressed in upstream Linux kernel stable releases via patches that reorder lock acquisition by moving ocfs2_del_inode_from_orphan outside the ip_alloc_sem critical section, as ip_alloc_sem protects allocation changes unrelated to orphan directory operations. Relevant commits include 2b884d52273c60c298bd570163e8053657bbaff6, 4b80b5a838a32437f2cae0662578bac216a2c51a, b02da26a992db0c0e2559acbda0fc48d4a2fd337, bc0fb5c7d54c78be43a536df0e20dee32adb27d3, and e049f7a9bd80b7319590789ea5e1c523d6339d91, available in kernel.org stable trees. Security practitioners should update to patched kernel versions using ocfs2.