CVE-2026-99132

xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

State: Published
Severity: Not scored
Published: Oct 28, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), which flushes the CIL push workqueue internally. If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to lock these buffers to fail them, causing a deadlock:

setlabel: holds buf lock -> flush_workqueue(xfs-cil) CIL push worker: xfs_buf_item_unpin -> xfs_buf_lock(same buf)

Remove the xfs_trans_bhold() calls so that commit releases the buffer locks normally. After the sync commit, re-acquire the buffers via mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f7664b31975bd893190708e76b2c424328f0c49b to before 16468281da17263095bd1906cf2d16a972f10791Affected f7664b31975bd893190708e76b2c424328f0c49b to before 45f124f3902bfae6a366d124db04f707264176fbAffected f7664b31975bd893190708e76b2c424328f0c49b to before d900946853c2d183fa0e199bae9ddbcd21795a18Affected f7664b31975bd893190708e76b2c424328f0c49b to before 83b2e511cf9ba22904b167e00fcbd85169b50b2cAffected f7664b31975bd893190708e76b2c424328f0c49b to before acd7f2f9b822b6e126f3e3c99c173e62aa315b6fAffected f7664b31975bd893190708e76b2c424328f0c49b to before e5456dec79c71c8ef8f9f9adb77d320f113b34dbAffected f7664b31975bd893190708e76b2c424328f0c49b to before 6353e5cd8c43d6e805cacbfbfecf4103571a7ff8Affected f7664b31975bd893190708e76b2c424328f0c49b to before 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ffAffected
LinuxLinux	4.18Affected before 4.18Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.161 through 6.6.Not affected 6.12.115 through 6.12.Not affected 6.18.59 through 6.18.Not affected 7.2.13 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

f7664b31975bd893190708e76b2c424328f0c49b to before 16468281da17263095bd1906cf2d16a972f10791Affected
f7664b31975bd893190708e76b2c424328f0c49b to before 45f124f3902bfae6a366d124db04f707264176fbAffected
f7664b31975bd893190708e76b2c424328f0c49b to before d900946853c2d183fa0e199bae9ddbcd21795a18Affected
f7664b31975bd893190708e76b2c424328f0c49b to before 83b2e511cf9ba22904b167e00fcbd85169b50b2cAffected
f7664b31975bd893190708e76b2c424328f0c49b to before acd7f2f9b822b6e126f3e3c99c173e62aa315b6fAffected
f7664b31975bd893190708e76b2c424328f0c49b to before e5456dec79c71c8ef8f9f9adb77d320f113b34dbAffected
f7664b31975bd893190708e76b2c424328f0c49b to before 6353e5cd8c43d6e805cacbfbfecf4103571a7ff8Affected
f7664b31975bd893190708e76b2c424328f0c49b to before 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ffAffected

LinuxLinux

4.18Affected
before 4.18Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.161 through 6.6.*Not affected
6.12.115 through 6.12.*Not affected
6.18.59 through 6.18.*Not affected
7.2.13 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.