All vulnerabilities
CVE-2026-93252

Linux: ocfs2: fix circular locking dependency in ocfs2_init_acl()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4936d4464d1ae10b5fbba64374085a0dcc060560Also 5b7b3c50c39ad0dc27e7418981e01c4183273f89, 8d88f52fbbbcc18adf4091a955511d0cf605bf11 and 6 moreCVE List
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4936d4464d1ae10b5fbba64374085a0dcc060560LinuxCVE List
  • 5b7b3c50c39ad0dc27e7418981e01c4183273f89LinuxCVE List
  • 8d88f52fbbbcc18adf4091a955511d0cf605bf11LinuxCVE List
  • 8931403ee3dcfe8a24a5267efec9d9460ab7a1b5LinuxCVE List
  • 1222f7a3183b35c0c566899fdaead5c7c4043076LinuxCVE List
  • 3.19LinuxCVE List
Show all 9 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix circular locking dependency in ocfs2_init_acl()

A lockdep warning indicates a circular locking dependency between &oi->ip_xattr_sem and &journal->j_trans_barrier:

WARNING: possible circular locking dependency detected is trying to acquire lock: (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0 fs/ocfs2/acl.c:367

but task is already holding lock: (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700 fs/ocfs2/journal.c:369

The deadlock involves two code paths: Path 1 (setxattr) where ocfs2_xattr_set() acquires ip_xattr_sem (write) and then starts a transaction, which acquires j_trans_barrier (read); and Path 2 (mkdir/mknod) where ocfs2_mknod() starts a transaction (j_trans_barrier read) and then calls ocfs2_init_acl(), which attempts to acquire ip_xattr_sem (read) on the parent directory to retrieve the default ACL.

Because rw_semaphores are subject to writer priority, a pending writer on j_trans_barrier (e.g., the journal commit thread) can cause Path 1 to block, while Path 2 is blocked waiting for Path 1 to release ip_xattr_sem.

The patch fixes the lock ordering by precomputing the ACL state before starting the OCFS2 transaction, while preserving POSIX ACL storage semantics and the existing inode/security initialization order. By reading the parent directory's default ACL and preparing the new inode's ACLs outside the transaction, ip_xattr_sem is always acquired before j_trans_barrier.

struct ocfs2_acl_state encapsulates the prepared ACL state, while ocfs2_acl_init_prepare() and ocfs2_acl_init_release() avoid code duplication between ocfs2_mknod() and ocfs2_init_security_and_acl(). ocfs2_calc_xattr_init() and ocfs2_init_acl() use this precomputed state, removing internal ip_xattr_sem acquisition and redundant disk reads.

Additionally, remove the ip_xattr_sem acquisition from ocfs2_xattr_set_handle(). This function is only used while initializing a new inode that has not yet been inserted into the inode hash or attached to a dentry, meaning there is no risk of concurrent access and the lock is unnecessary.

Text from CVE List

Affected versions 26

  • Linuxaffected: 16c8d569f5704a84164f30ff01b29879f3438065 before 4936d4464d1ae10b5fbba64374085a0dcc060560CVE List
  • Linuxaffected: 16c8d569f5704a84164f30ff01b29879f3438065 before caf3056936fb8b5ce92e419cf8b246ce9c437343CVE List
  • Linuxaffected: 16c8d569f5704a84164f30ff01b29879f3438065 before 5b7b3c50c39ad0dc27e7418981e01c4183273f89CVE List
  • Linuxaffected: 16c8d569f5704a84164f30ff01b29879f3438065 before 8d88f52fbbbcc18adf4091a955511d0cf605bf11CVE List
  • Linuxaffected: 16c8d569f5704a84164f30ff01b29879f3438065 before 8931403ee3dcfe8a24a5267efec9d9460ab7a1b5CVE List
  • Linuxaffected: 16c8d569f5704a84164f30ff01b29879f3438065 before f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758CVE List
  • Linuxaffected: 16c8d569f5704a84164f30ff01b29879f3438065 before 1222f7a3183b35c0c566899fdaead5c7c4043076CVE List
  • Linuxaffected: 16c8d569f5704a84164f30ff01b29879f3438065 before bd7c05fb4a4776dff5a87b19008d28458647d15dCVE List
  • Linuxaffected: 15ac59a84750b3afc0a2b6f2636c4f7e6cbd6d5eCVE List
  • Linuxaffected: b35bb8a41795caa05e09c3aacf7d78f1f20bac04CVE List
  • Linuxaffected: 1d5fdc1307eeb04b334c5dc23e11dbd6068d90ebCVE List
  • Linuxaffected: a66174eb4a149b7919d174d9a7ce6ad9909c5ee2CVE List
  • Linuxaffected: 3.18.111 before 3.19CVE List
  • Linuxaffected: 4.4.134 before 4.5CVE List
  • Linuxaffected: 4.9.104 before 4.10CVE List
  • Linuxaffected: 4.14.37 before 4.15CVE List
  • Linuxaffected: 4.16CVE List
  • Linuxunaffected: all versions before 4.16CVE List
  • Linuxunaffected: 5.10.270 through 5.10.*CVE List
  • Linuxunaffected: 5.15.221 through 5.15.*CVE List
  • Linuxunaffected: 6.1.188 through 6.1.*CVE List
  • Linuxunaffected: 6.6.157 through 6.6.*CVE List
  • Linuxunaffected: 6.12.110 through 6.12.*CVE List
  • Linuxunaffected: 6.18.52 through 6.18.*CVE List
  • Linuxunaffected: 7.2.6 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8