Deadlock in Linux kernel - CVE-2026-93252
Published: September 25, 2026
Vulnerability identifier: #VU152149
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-93252
CWE-ID: CWE-833
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper lock ordering in the OCFS2 ACL initialization and extended attribute handling paths when concurrently performing extended attribute updates and filesystem node-creation operations. A local user can perform concurrent extended attribute updates and mkdir or mknod operations to cause a denial of service.
Exploitation depends on a pending writer on the journal transaction barrier causing the conflicting lock acquisition paths to block.
Affected software
Linux kernel
How to mitigate CVE-2026-93252
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/1222f7a3183b35c0c566899fdaead5c7c4043076
- https://git.kernel.org/stable/c/4936d4464d1ae10b5fbba64374085a0dcc060560
- https://git.kernel.org/stable/c/5b7b3c50c39ad0dc27e7418981e01c4183273f89
- https://git.kernel.org/stable/c/8931403ee3dcfe8a24a5267efec9d9460ab7a1b5
- https://git.kernel.org/stable/c/8d88f52fbbbcc18adf4091a955511d0cf605bf11
- https://git.kernel.org/stable/c/bd7c05fb4a4776dff5a87b19008d28458647d15d
- https://git.kernel.org/stable/c/caf3056936fb8b5ce92e419cf8b246ce9c437343
- https://git.kernel.org/stable/c/f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758