CVEvulnerability
CVE-2026-93269
- Status
- Received
- Published
- 2026-09-24
- Last modified
- 2026-10-19
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Description
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix circular lock dependency in ext4_ext_migrate
Move iput(tmp_inode) after ext4_writepages_up_write() to avoid a
circular lock dependency between s_writepages_rwsem and sb_internal
(freeze protection).
The deadlock scenario:
CPU0 (EXT4_IOC_MIGRATE) CPU1 (orphan cleanup during mount)
---- ----
ext4_ext_migrate()
ext4_writepages_down_write()
s_writepages_rwsem (write)
ext4_evict_inode()
sb_start_intwrite() [sb_internal]
...
ext4_writepages()
s_writepages_rwsem (read) [BLOCKED]
iput(tmp_inode)
ext4_evict_inode()
sb_start_intwrite() [BLOCKED]
The tmp_inode is a temporary inode with nlink=0 created solely for
building the extent tree. Its eviction does not require
s_writepages_rwsem protection, so deferring iput() until after
releasing the rwsem is safe.
References
- https://git.kernel.org/stable/c/32f7ab52875ec7f800ca67e7176e5743a84baddf git.kernel.org
- https://git.kernel.org/stable/c/452950461241dfed8b1d32e94b227db38c99c5af git.kernel.org
- https://git.kernel.org/stable/c/a897682793eba5de51ee6f3152760374afa629cf git.kernel.org
- https://git.kernel.org/stable/c/ada23457d4748d6e9c36c6f871fc29a6f558c48c git.kernel.org
- https://git.kernel.org/stable/c/e4223231b6860141813637a6413c2371ae4d6fa8 git.kernel.org