SB20261023238 - Excessive Iteration in Linux kernel fs

Description

This security bulletin contains information about 1 vulnerability.

1) Excessive Iteration (CVE-ID: CVE-2026-98924)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by blocking filesystem unmount operations for an extended period.

The vulnerability exists due to excessive repeated iteration in the Linux kernel's evict_inodes() function when processing inode eviction after removal of a disk that is still in use. A local user can trigger inode eviction under conditions where many referenced inodes occupy the head of the inode list to cause repeated scans after rescheduling, keeping s_umount held for an extended period and blocking concurrent unmount attempts.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3cdc6e12ff79f0f8a3ba62d7e61474ae4b5e119a
• https://git.kernel.org/stable/c/7459c021874246c196f397686e100702f059b9e7
• https://git.kernel.org/stable/c/e4f3e476cd4066a815ef68cd6caa1828b9c167d5