Description
In the Linux kernel, the following vulnerability has been resolved:

xfs: restore nofs context unconditionally in xfs_trans_roll

When __xfs_trans_commit() fails in xfs_trans_roll(), the NOFS context
is cleared but only restored in the success path. This leaves the
error path without nofs protection, causing a circular lock dependency
between xfs_nondir_ilock_class and fs_reclaim:

CPU0 CPU1
---- ----
lock(&xfs_nondir_ilock_class);
lock(fs_reclaim);
lock(&xfs_nondir_ilock_class);
lock(fs_reclaim);

Fix this by moving xfs_trans_set_context() before the error check so
that nofs context is always restored on the new transaction.
Published: 2026-09-04
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel bug in the XFS file system causes the NOFS context to be cleared when a transaction commit fails, but the context is only restored on the success path. This omission removes protection against nonfile operations and creates a circular lock dependency between the non‑directory inode lock class and the file system reclamation lock. If the system hits the error path during a transaction roll‑back, the scheduler can deadlock waiting for the two locks, leading to a system halt or degraded performance. The vulnerability cannot be exploited remotely; it requires kernel code changes or local privileged influence but the effect is a denial of Service by freezing kernel threads.

Affected Systems

Affected systems are Linux kernel implementations that use the XFS file system. The precise kernel version numbers that contain the flaw are not listed; any Linux kernel prior to the commit that fixed the issue is potentially vulnerable. The fix is addressed in the kernel source by moving the NOFS context restoration before the error check in xfs_trans_roll.

Risk and Exploitability

The Common Vulnerability Scoring System (CVSS) for this issue is not supplied; however the severity is high because a live kernel can deadlock, halting system operations. The Exploit Prediction Scoring System (EPSS) is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is confined to local kernel context and would require an attacker with sufficient privileges to trigger transaction failures or execute code that induces the error path. Consequently, the risk remains significant for systems that run XFS and have not applied the latest kernel update.

Generated by OpenCVE AI on September 4, 2026 at 19:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the kernel patch that moves the NOFS context restoration before the error check in xfs_trans_roll.
  • Upgrade the Linux kernel to a version that incorporates the fix, then reboot the system to ensure the new kernel is active.
  • Verify that no XFS filesystems report unresolved lock or deadlock errors in journaling logs and trim or repair affected volumes if necessary.

Generated by OpenCVE AI on September 4, 2026 at 19:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Fri, 04 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfs_trans_roll When __xfs_trans_commit() fails in xfs_trans_roll(), the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a circular lock dependency between xfs_nondir_ilock_class and fs_reclaim: CPU0 CPU1 ---- ---- lock(&xfs_nondir_ilock_class); lock(fs_reclaim); lock(&xfs_nondir_ilock_class); lock(fs_reclaim); Fix this by moving xfs_trans_set_context() before the error check so that nofs context is always restored on the new transaction.
Title xfs: restore nofs context unconditionally in xfs_trans_roll
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-04T15:13:18.282Z

Reserved: 2026-08-26T14:34:25.794Z

Link: CVE-2026-80804

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T16:18:07.397

Modified: 2026-09-04T16:18:07.397

Link: CVE-2026-80804

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T19:30:04Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')