CVE-2026-46061
published 2026-05-27CVE-2026-46061: In the Linux kernel, the following vulnerability has been resolved: jbd2: fix deadlock in jbd2_journal_cancel_revoke() Commit f76d4c28a46a ("fs/jbd2: use…
medium5.5
In the Linux kernel, the following vulnerability has been resolved:
jbd2: fix deadlock in jbd2_journal_cancel_revoke()
Commit f76d4c28a46a ("fs/jbd2: use sleeping version of
__find_get_block()") changed jbd2_journal_cancel_revoke() to use
__find_get_block_nonatomic() which holds the folio lock instead of
i_private_lock. This breaks the lock ordering (folio -> buffer) and
causes an ABBA deadlock when the filesystem blocksize < pagesize:
T1 T2
ext4_mkdir()
ext4_init_new_dir()
ext4_append()
ext4_getblk()
lock_buffer() <- A
sync_blockdev()
blkdev_writepages()
writeback_iter()
writeback_get_folio()
folio_lock() <- B
ext4_journal_get_create_access()
jbd2_journal_cancel_revoke()
__find_get_block_nonatomic()
folio_lock() <- B
block_write_full_folio()
lock_buffer() <- A
This can occasionally cause generic/013 to hang.
Fix by only calling __find_get_block_nonatomic() when the passed
buffer_head doesn't belong to the bdev, which is the only case that we
need to look up its bdev alias. Otherwise, the lookup is redundant since
the found buffer_head is equal to the one we passed in.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 6.12.31 < 6.12.86 | 6.12.86 |
| linux | linux | >= 6.14.9 < 6.15 | 6.15 |
| linux | linux | >= f1c5aa614b5c251f93a6a4c8c26001d5e9e53fd6 < dff07cc98fdf6af57a7c054dc09b2050a9d5c287 | dff07cc98fdf6af57a7c054dc09b2050a9d5c287 |
| linux | linux | >= f76d4c28a46a9260d85e00dafc8f46d369365d33 < 2b2fee890250ab647a601124471a334bb01a0790 | 2b2fee890250ab647a601124471a334bb01a0790 |
| linux | linux | >= f76d4c28a46a9260d85e00dafc8f46d369365d33 < bbd943d6a2d566428324b516a37f98328dfb802d | bbd943d6a2d566428324b516a37f98328dfb802d |
| linux | linux | >= f76d4c28a46a9260d85e00dafc8f46d369365d33 < 981fcc5674e67158d24d23e841523eccba19d0e7 | 981fcc5674e67158d24d23e841523eccba19d0e7 |
| linux | linux_kernel | — | — |