CRITICAL: CVE-2026-31589 (CVSS 9.8) — multiple products

CVE: CVE-2026-31589

CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: CRITICAL

Status: Critical advisory

Affected

_See vendor advisory_

Summary

In the Linux kernel, the following vulnerability has been resolved:

mm: call ->free_folio() directly in folio_unmap_invalidate()

We can only call filemap_free_folio() if we have a reference to (or hold a

lock on) the mapping. Otherwise, we've already removed the folio from the

mapping so it no longer pins the mapping and the mapping can be removed,

causing a use-after-free when accessing mapping->a_ops.

Follow the same pattern as __remove_mapping() and load the free_folio

function pointer before dropping the lock on the mapping. That lets us

make filemap_free_folio() static as this was the only caller outside

filemap.c.

Verified Sources

References

https://git.kernel.org/stable/c/615d9bb2ccad42f9e21d837431e401db2e471195
https://git.kernel.org/stable/c/b667df39d98a7a24be7c2a40ff0863dac1ad2cd7
https://git.kernel.org/stable/c/c330e65ea59c4805d6ab6757c4ddfe8c63acef31

_Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation._

Lyrie Verdict

A vulnerability of this severity is exactly what Lyrie's anti-rogue-AI defense is built for: continuous, autonomous monitoring that doesn't wait for human reaction time.

#critical