CVE-2026-99132None▾ Sunlit

xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), wh…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 28, 2026

Updated

Oct 28, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

—

Platforms

—

Source

CVEORG

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Oct 29.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 1 day

Oct 28, 2026Published
Disclosed via CVEORG
Oct 29, 2026EPSS first tracked
0.2%

Linux #cve.org

Affected

Linux >= f7664b31975bd893190708e76b2c424328f0c49b < e5456dec79c71c8ef8f9f9adb77d320f113b34db
Linux >= f7664b31975bd893190708e76b2c424328f0c49b < 6353e5cd8c43d6e805cacbfbfecf4103571a7ff8
Linux >= f7664b31975bd893190708e76b2c424328f0c49b < 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff
Linux 4.18

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), which flushes the CIL push workqueue internally. If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to lock these buffers to fail them, causing a deadlock:

setlabel: holds buf lock -> flush_workqueue(xfs-cil) CIL push worker: xfs_buf_item_unpin -> xfs_buf_lock(same buf)

Remove the xfs_trans_bhold() calls so that commit releases the buffer locks normally. After the sync commit, re-acquire the buffers via mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.

Affected

Linux >= f7664b31975bd893190708e76b2c424328f0c49b < e5456dec79c71c8ef8f9f9adb77d320f113b34db
Linux >= f7664b31975bd893190708e76b2c424328f0c49b < 6353e5cd8c43d6e805cacbfbfecf4103571a7ff8
Linux >= f7664b31975bd893190708e76b2c424328f0c49b < 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff
Linux 4.18

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

setlabel: holds buf lock -> flush_workqueue(xfs-cil) CIL push worker: xfs_buf_item_unpin -> xfs_buf_lock(same buf)

Remove the xfs_trans_bhold() calls so that commit releases the buffer locks normally. After the sync commit, re-acquire the buffers via mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.