All vulnerabilities
CVE-2026-99132

Linux: xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in6353e5cd8c43d6e805cacbfbfecf4103571a7ff8Also 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ffCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 6353e5cd8c43d6e805cacbfbfecf4103571a7ff8LinuxCVE List
  • 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ffLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), which flushes the CIL push workqueue internally. If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to lock these buffers to fail them, causing a deadlock:

setlabel: holds buf lock -> flush_workqueue(xfs-cil) CIL push worker: xfs_buf_item_unpin -> xfs_buf_lock(same buf)

Remove the xfs_trans_bhold() calls so that commit releases the buffer locks normally. After the sync commit, re-acquire the buffers via mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.

Text from CVE List

Affected versions 8

  • Linuxaffected: f7664b31975bd893190708e76b2c424328f0c49b before e5456dec79c71c8ef8f9f9adb77d320f113b34dbCVE List
  • Linuxaffected: f7664b31975bd893190708e76b2c424328f0c49b before 6353e5cd8c43d6e805cacbfbfecf4103571a7ff8CVE List
  • Linuxaffected: f7664b31975bd893190708e76b2c424328f0c49b before 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ffCVE List
  • Linuxaffected: 4.18CVE List
  • Linuxunaffected: all versions before 4.18CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3