# CVE-2026-31714: linux: In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to avoid memory leak in f2fs_rename()...

CVE-2026-31714 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-31714, released May 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-31714
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0011
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 1, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to avoid memory leak in f2fs_rename()  syzbot reported a f2fs bug as below:  BUG: memory leak unreferenced object 0xffff888127f70830 (size 16):   comm "syz.0.23", pid 6144, jiffies 4294943712   hex dump (first 16 bytes):     3c af 57 72 5b e6 8f ad 6e 8e fd 33 42 39 03 ff  <.Wr[...n..3B9..   backtrace (crc 925f8a80):     kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]     slab_post_alloc_hook mm/slub.c:4520 [inline]     slab_alloc_node mm/slub.c:4844 [inline]     __do_kmalloc_node mm/slub.c:5237 [inline]     __kmalloc_noprof+0x3bd/0x560 mm/slub.c:5250     kmalloc_noprof include/linux/slab.h:954 [inline]     fscrypt_setup_filename+0x15e/0x3b0 fs/crypto/fname.c:364     f2fs_setup_filename+0x52/0xb0 fs/f2fs/dir.c:143     f2fs_rename+0x159/0xca0 fs/f2fs/namei.c:961     f2fs_rename2+0xd5/0xf20 fs/f2fs/namei.c:1308     vfs_rename+0x7ff/0x1250 fs/namei.c:6026     filename_renameat2+0x4f4/0x660 fs/namei.c:6144     __do_sys_renameat2 fs/namei.c:6173 [inline]     __se_sys_renameat2 fs/namei.c:6168 [inline]     __x64_sys_renameat2+0x59/0x80 fs/namei.c:6168     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]     do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94     entry_SYSCALL_64_after_hwframe+0x77/0x7f  The root cause is in commit 40b2d55e0452 ("f2fs: fix to create selinux label during whiteout initialization"), we added a call to f2fs_setup_filename() without a matching call to f2fs_free_filename(), fix it.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.85-1 | [DEBIAN-CVE-2026-31714](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31714.md) | May 15, 2026 |
| Linux | linux Debian 14 | 7.0.3-1 | [DEBIAN-CVE-2026-31714](https://patchblox.com/security/data/fix/linux/debian-cve-2026-31714.md) | May 15, 2026 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.