All vulnerabilities
CVE-2026-93269

Linux: ext4: fix circular lock dependency in ext4_ext_migrate

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in452950461241dfed8b1d32e94b227db38c99c5afAlso 32f7ab52875ec7f800ca67e7176e5743a84baddf, 4.10 and 4 moreCVE List
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

Show all 7 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix circular lock dependency in ext4_ext_migrate

Move iput(tmp_inode) after ext4_writepages_up_write() to avoid a circular lock dependency between s_writepages_rwsem and sb_internal (freeze protection).

The deadlock scenario:

CPU0 (EXT4_IOC_MIGRATE) CPU1 (orphan cleanup during mount) ---- ---- ext4_ext_migrate() ext4_writepages_down_write() s_writepages_rwsem (write) ext4_evict_inode() sb_start_intwrite() [sb_internal] ... ext4_writepages() s_writepages_rwsem (read) [BLOCKED] iput(tmp_inode) ext4_evict_inode() sb_start_intwrite() [BLOCKED]

The tmp_inode is a temporary inode with nlink=0 created solely for building the extent tree. Its eviction does not require s_writepages_rwsem protection, so deferring iput() until after releasing the rwsem is safe.

Text from CVE List

Affected versions 22

  • Linuxaffected: cb85f4d23f794e24127f3e562cb3b54b0803f456 before 452950461241dfed8b1d32e94b227db38c99c5afCVE List
  • Linuxaffected: cb85f4d23f794e24127f3e562cb3b54b0803f456 before ada23457d4748d6e9c36c6f871fc29a6f558c48cCVE List
  • Linuxaffected: cb85f4d23f794e24127f3e562cb3b54b0803f456 before e4223231b6860141813637a6413c2371ae4d6fa8CVE List
  • Linuxaffected: cb85f4d23f794e24127f3e562cb3b54b0803f456 before 32f7ab52875ec7f800ca67e7176e5743a84baddfCVE List
  • Linuxaffected: cb85f4d23f794e24127f3e562cb3b54b0803f456 before a897682793eba5de51ee6f3152760374afa629cfCVE List
  • Linuxaffected: eb799e163dc2bc1ea0a4820b66f79d32a5e907dfCVE List
  • Linuxaffected: bcc1eab71a67c46b9e24544ac7923f44444174ceCVE List
  • Linuxaffected: 8cf20fb73e73a4c4df0328b5297842c5ef34fdd9CVE List
  • Linuxaffected: e5d25003d059649e18a249635ed5ca7a7b1de5adCVE List
  • Linuxaffected: 69f8a7991fd93c49096ddd11574db3e7df238b7bCVE List
  • Linuxaffected: 4.9.215 before 4.10CVE List
  • Linuxaffected: 4.14.172 before 4.15CVE List
  • Linuxaffected: 4.19.107 before 4.20CVE List
  • Linuxaffected: 5.4.23 before 5.5CVE List
  • Linuxaffected: 5.5.7 before 5.6CVE List
  • Linuxaffected: 5.6CVE List
  • Linuxunaffected: all versions before 5.6CVE List
  • Linuxunaffected: 6.6.157 through 6.6.*CVE List
  • Linuxunaffected: 6.12.110 through 6.12.*CVE List
  • Linuxunaffected: 6.18.52 through 6.18.*CVE List
  • Linuxunaffected: 7.2.6 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5