CVE-2026-31589 PUBLISHED

mm: call ->free_folio() directly in folio_unmap_invalidate()

Assigner: Linux
Reserved: 09.03.2026 Published: 24.04.2026 Updated: 24.04.2026

In the Linux kernel, the following vulnerability has been resolved:

mm: call ->free_folio() directly in folio_unmap_invalidate()

We can only call filemap_free_folio() if we have a reference to (or hold a lock on) the mapping. Otherwise, we've already removed the folio from the mapping so it no longer pins the mapping and the mapping can be removed, causing a use-after-free when accessing mapping->a_ops.

Follow the same pattern as __remove_mapping() and load the free_folio function pointer before dropping the lock on the mapping. That lets us make filemap_free_folio() static as this was the only caller outside filemap.c.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to b667df39d98a7a24be7c2a40ff0863dac1ad2cd7 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to c330e65ea59c4805d6ab6757c4ddfe8c63acef31 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • unaffected from 6.19.14 to 6.19.* (incl.)
  • unaffected from 7.0.1 to 7.0.* (incl.)

References