CVE-2026-31586

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the function cgwb release workfn(). The function calls css put(wb->blkcg css) and subsequently accesses wb->blkcg css again via blkcg unpin online(). If css put() drops the last reference, the blkcg can be freed asynchronously before blkcg unpin online() dereferences the pointer to access blkcg->online pin.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.