SB20261029175 - Deadlock in Linux kernel xfs libxfs

Description

This security bulletin contains information about 1 vulnerability.

1) Deadlock (CVE-ID: CVE-2026-99132)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through an XFS filesystem deadlock.

The vulnerability exists due to a deadlock caused by holding superblock buffer locks across a synchronous transaction commit in xfs_sync_sb_buf() when filesystem shutdown occurs during a committed item list (CIL) push. A local privileged user can trigger an affected superblock synchronization under these conditions to cause the committing task and CIL push worker to wait indefinitely for each other, blocking affected filesystem operations.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff
• https://git.kernel.org/stable/c/6353e5cd8c43d6e805cacbfbfecf4103571a7ff8
• https://git.kernel.org/stable/c/e5456dec79c71c8ef8f9f9adb77d320f113b34db