---
id: CVE-2026-99132
title: 'xfs: don''t hold buffer locks across sync transaction commit in xfs_sync_sb_buf'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

  xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous
  xfs_trans_commit(), wh…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f7664b31975bd893190708e76b2c424328f0c49b <
    e5456dec79c71c8ef8f9f9adb77d320f113b34db
  - >-
    Linux >= f7664b31975bd893190708e76b2c424328f0c49b <
    6353e5cd8c43d6e805cacbfbfecf4103571a7ff8
  - >-
    Linux >= f7664b31975bd893190708e76b2c424328f0c49b <
    41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff
  - Linux 4.18
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:34:45.756Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99132'
references:
  - url: 'https://git.kernel.org/stable/c/e5456dec79c71c8ef8f9f9adb77d320f113b34db'
  - url: 'https://git.kernel.org/stable/c/6353e5cd8c43d6e805cacbfbfecf4103571a7ff8'
  - url: 'https://git.kernel.org/stable/c/41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.436Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf

xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous
xfs_trans_commit(), which flushes the CIL push workqueue internally.
If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to
lock these buffers to fail them, causing a deadlock:

  setlabel:          holds buf lock -> flush_workqueue(xfs-cil)
  CIL push worker:   xfs_buf_item_unpin -> xfs_buf_lock(same buf)

Remove the xfs_trans_bhold() calls so that commit releases the buffer
locks normally.  After the sync commit, re-acquire the buffers via
mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.

## Affected

- `Linux >= f7664b31975bd893190708e76b2c424328f0c49b < e5456dec79c71c8ef8f9f9adb77d320f113b34db`
- `Linux >= f7664b31975bd893190708e76b2c424328f0c49b < 6353e5cd8c43d6e805cacbfbfecf4103571a7ff8`
- `Linux >= f7664b31975bd893190708e76b2c424328f0c49b < 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff`
- `Linux 4.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.