All vulnerabilities
CVE-2026-98444

Linux: xfs: drop dquot flush lock when we can't find a buffer to flush

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in41bc624377f08125eae164c62ce043791ade93b7Also 6.13CVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: drop dquot flush lock when we can't find a buffer to flush

LOLLM noticed that xfs_qm_flush_one fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is going to drop the dqflock, so we need to do it ourselves.

Text from CVE List

Affected versions 8

  • Linuxaffected: ca378189fdfa890a4f0622f85ee41b710bbac271 before 41bc624377f08125eae164c62ce043791ade93b7CVE List
  • Linuxaffected: ca378189fdfa890a4f0622f85ee41b710bbac271 before ffb48dccce1960a9ea24463a2f3c21d124d6b672CVE List
  • Linuxaffected: d331fc154564548b605cde8427442b54c87d7fd3CVE List
  • Linuxaffected: 6.12.14 before 6.13CVE List
  • Linuxaffected: 6.13CVE List
  • Linuxunaffected: all versions before 6.13CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2