Cloudanix VulnDB

CVE-2026-98444

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's XFS filesystem could cause the system to freeze when handling storage quotas under certain conditions.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to release the dquot flush lock in xfs_qm_flush_one when buffer acquisition fails leaves the lock permanently held, enabling deadlock or resource exhaustion in XFS quota flushing paths under race conditions.

Why it matters to the business

Filesystem operations may hang indefinitely on affected Linux systems using XFS with quotas enabled, leading to service disruption, delayed data access, and potential need for manual intervention or reboot.

How an attack unfolds

An attacker with local access triggers concurrent XFS quota flush operations that race to acquire buffers; when a buffer cannot be obtained the lock is not dropped, allowing the attacker to force persistent lock contention and denial of service.

How to fix it

Apply the upstream kernel patch that ensures the dquot flush lock is dropped when no buffer is found; rebuild and deploy the updated kernel across all affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting the xfs_qm_flush_one function for explicit dqflock release on buffer failure paths; test by reproducing quota flush under high contention and verifying no locks remain held.

Typical attack path

  1. Obtain local access on a system using XFS with quotas
  2. Induce concurrent quota flush activity via file operations or quota commands
  3. Force buffer allocation failure during flush
  4. Exploit unreleased dqflock to cause system-wide hang

How to detect it

Review kernel logs and dmesg for XFS quota flush errors or lock contention warnings; inspect process traces showing stuck xfs threads holding dqflock; correlate with high I/O wait times on XFS volumes.

What your security team should do

  • Prioritize kernel upgrade on all XFS systems within the next maintenance window
  • Monitor for XFS-related hangs or high lock contention in production
  • Disable quotas temporarily if immediate patching is not feasible

The record

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfs_qm_flush_one fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is going to drop the dqflock, so we need to do it ourselves.

Affected packages

Ecosystem Package Introduced Fixed