Deadlock in Linux kernel - CVE-2026-99132
Published: October 29, 2026
Vulnerability identifier: #VU158450
CSH Severity: Low
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99132
CWE-ID: CWE-833
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to cause a denial of service through an XFS filesystem deadlock.
The vulnerability exists due to a deadlock caused by holding superblock buffer locks across a synchronous transaction commit in xfs_sync_sb_buf() when filesystem shutdown occurs during a committed item list (CIL) push. A local privileged user can trigger an affected superblock synchronization under these conditions to cause the committing task and CIL push worker to wait indefinitely for each other, blocking affected filesystem operations.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99132
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2