CVE-2026-93269
Published: September 26, 2026Last modified: September 26, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: fix circular lock dependency in ext4_ext_migrate Move iput(tmp_inode) after ext4_writepages_up_write() to avoid a circular lock dependency between s_writepages_rwsem and sb_internal (freeze protection). The deadlock scenario: CPU0 (EXT4_IOC_MIGRATE) CPU1 (orphan cleanup during mount) ---- ---- ext4_ext_migrate() ext4_writepages_down_write() s_writepages_rwsem (write) ext4_evict_inode() sb_start_intwrite() [sb_internal] ... ext4_writepages() s_writepages_rwsem (read) [BLOCKED] iput(tmp_inode) ext4_evict_inode() sb_start_intwrite() [BLOCKED] The tmp_inode is a temporary inode with nlink=0 created solely for building the extent tree. Its eviction does not require s_writepages_rwsem protection, so deferring iput() until after releasing the rwsem is safe.
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | linux-lts | Vulnerable (6.1.182-r0) |
| 25 LTS | linux-lts | Vulnerable (6.12.103-r0) | |
| Stream | linux-lts | Fixed (6.18.53-r0) |
References
- https://git.kernel.org/stable/c/32f7ab52875ec7f800ca67e7176e5743a84baddf
- https://git.kernel.org/stable/c/452950461241dfed8b1d32e94b227db38c99c5af
- https://git.kernel.org/stable/c/a897682793eba5de51ee6f3152760374afa629cf
- https://git.kernel.org/stable/c/ada23457d4748d6e9c36c6f871fc29a6f558c48c
- https://git.kernel.org/stable/c/e4223231b6860141813637a6413c2371ae4d6fa8