CVE-2026-31450

OVERVIEW CVE-2026-31450 is a use-after-free vulnerability in the Linux kernel's ext4 filesystem implementation, specifically within the inode journal node attachment mechanism. The flaw exists in the ext4_inode_attach_jinode() function, which prematurely publishes the jinode pointer to concurrent users before the underlying jbd2_inode structure is fully initialized. This allows other kernel threads to access an incompletely initialized jinode, leading to potential kernel crashes when the fast commit flush path attempts to dereference uninitialized memory structures. The vulnerability affects all Linux kernel versions with the vulnerable ext4 code path. SEVERITY This vulnerability has a local attack vector requiring no special privileges, as any user with filesystem access during concurrent file operations could trigger the race condition. The attack complexity is low, as the race window is inherent to normal ext4 fast commit operations. The impact is high for availability, as demonstrated by the kernel panic in the provided crash log where dereferencing an uninitialized i_vfs_inode->i_mapping pointer causes immediate kernel failure. There is no confidentiality or integrity impact. The CVSS score is not yet assigned, though the EPSS score of 0.00024 indicates minimal real-world exploit prevalence. EXPLOITATION STATUS This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. The low EPSS score and inactive hot list status suggest limited threat actor interest. However, the straightforward nature of the race condition and its reproducibility in the kernel's normal operational pathway means exploit code could be easily developed. Community attention appears focused on the upstream kernel patch rather than weaponization efforts.