Cloudanix VulnDB

CVE-2026-99132

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A locking mistake in the Linux filesystem code can freeze the whole computer when certain internal operations overlap, requiring a reboot to recover.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Holds XFS superblock buffer locks across a synchronous transaction commit that internally flushes the CIL workqueue; a concurrent shutdown can cause xfs_buf_item_unpin to attempt re-acquisition of the same locks, resulting in deadlock.

Why it matters to the business

Linux systems using the XFS filesystem may experience kernel deadlocks or forced shutdowns during metadata synchronization, leading to service outages and potential data unavailability until reboot.

How an attack unfolds

An attacker with local access triggers filesystem operations that invoke xfs_sync_sb_buf while simultaneously inducing a shutdown or error condition during the CIL push, forcing the buffer lock contention that deadlocks the system.

How to fix it

Update the Linux kernel to a version containing the fix that removes xfs_trans_bhold calls from xfs_sync_sb_buf and re-acquires buffers after the commit via mp->m_sb_bp and mp->m_rtsb_bp.

How to confirm the fix worked

Confirm the kernel source contains the corrected xfs_sync_sb_buf implementation without xfs_trans_bhold across the commit, and verify no deadlock occurs under simulated shutdown during CIL push in testing.

Typical attack path

  1. Obtain local code execution or shell access on a Linux system with XFS.
  2. Perform filesystem metadata writes that call xfs_sync_sb_buf.
  3. Induce a shutdown or error path during the synchronous commit and CIL flush.
  4. Trigger xfs_buf_item_unpin to contend for the held buffers, causing deadlock.

How to detect it

Review kernel logs for XFS buffer lock contention warnings or hung task traces involving xfs_trans_commit and xfs_buf_item_unpin during shutdown; inspect dmesg and syslog for deadlock signatures after unexpected system hangs.

What your security team should do

  • Prioritize kernel updates for all XFS deployments within the next maintenance window.
  • Monitor upstream kernel changelogs for XFS-related fixes.
  • Test filesystem stress and shutdown scenarios in staging environments before production rollout.

The record

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), which flushes the CIL push workqueue internally. If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to lock these buffers to fail them, causing a deadlock: setlabel: holds buf lock -> flush_workqueue(xfs-cil) CIL push worker: xfs_buf_item_unpin -> xfs_buf_lock(same buf) Remove the xfs_trans_bhold() calls so that commit releases the buffer locks normally. After the sync commit, re-acquire the buffers via mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.

Affected packages

Ecosystem Package Introduced Fixed