CVE-2026-93140 - Vulnerability Details

- udf: Mark LVID buffer as uptodate before marking it dirty

Description

In the Linux kernel, the following vulnerability has been resolved:

udf: Mark LVID buffer as uptodate before marking it dirty

When an I/O error occurs while writing the Logical Volume Integrity
Descriptor (LVID) buffer to the block device, the block layer's completion
handler (`end_buffer_write_sync()`) clears the `BH_Uptodate` flag on the
buffer. However, the buffer still contains valid LVID data in memory. If
the filesystem is subsequently remounted read-write or synced,
`udf_open_lvid()` or `udf_sync_fs()` will modify the LVID buffer and call
`mark_buffer_dirty()`. This triggers a spurious
`WARN_ON_ONCE(!buffer_uptodate(bh))` warning in `mark_buffer_dirty()`
because the buffer is not marked uptodate, even though its in-memory
contents are valid and are about to be overwritten.

To prevent this spurious warning, unconditionally set the `BH_Uptodate`
flag before calling `mark_buffer_dirty()` in `udf_open_lvid()` and
`udf_sync_fs()`. This acknowledges that the in-memory buffer is valid and
matches the workaround previously applied to `udf_close_lvid()` in commit
853a0c25baf9 ("udf: Mark LVID buffer as uptodate before marking it dirty").
Extending this workaround ensures consistent behavior across all LVID
updates.

Buffer I/O error on dev loop0, logical block 128, lost sync page write
------------[ cut here ]------------
!buffer_uptodate(bh)
WARNING: fs/buffer.c:1087 at mark_buffer_dirty+0x299/0x410 fs/buffer.c:1087
...
Call Trace:
<TASK>
udf_open_lvid+0x369/0x5b0 fs/udf/super.c:2078
udf_reconfigure+0x336/0x540 fs/udf/super.c:679
reconfigure_super+0x232/0x8f0 fs/super.c:1080
vfs_cmd_reconfigure fs/fsopen.c:268 [inline]
vfs_fsconfig_locked+0x171/0x320 fs/fsopen.c:297
__do_sys_fsconfig fs/fsopen.c:463 [inline]
__se_sys_fsconfig+0x6b9/0x810 fs/fsopen.c:350
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
</TASK>

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

When an I/O error occurs while writing the Logical Volume Integrity Descriptor buffer, the kernel’s completion handler clears the buffer’s uptodate flag but retains valid in‑memory data. Subsequent attempts to mark the buffer dirty trigger a spurious WARN_ON_ONCE warning because the flag is reset. The kernel patch restores the uptodate flag before marking the buffer dirty, preventing the warning. There is no evidence that this flaw allows an attacker to alter data integrity, force a denial of service, or gain any other security advantage.

Affected Systems

All Linux kernel releases that contain the UDF (Universal Disk Format) filesystem and have not yet incorporated the patch that restores the uptodate flag for the LVID buffer. The vulnerability is identified in the kernel’s buffer management code and applies to the UDF filesystem component of the Linux kernel.

Risk and Exploitability

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a very low likelihood of exploitation. The CVSS score is not disclosed but the lack of a clear attack vector and the trivial nature of the bug suggest that the overall risk to confidentiality, integrity, or availability remains negligible.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`853a0c25baf96b028de1654bea1e0c8857eadf3d`	affected	< e6461ef34f91ad7dbffdf912b3d661a7dd892931
`853a0c25baf96b028de1654bea1e0c8857eadf3d`	affected	< 359cea636f4a74a96c01a8050f155e12840c079a
`853a0c25baf96b028de1654bea1e0c8857eadf3d`	affected	< a4c4e38b356ad4c1f90478124922917489137c08
`853a0c25baf96b028de1654bea1e0c8857eadf3d`	affected	< 8034ddf4751d9143c5ef7eebe3d4f33218fdd378
`853a0c25baf96b028de1654bea1e0c8857eadf3d`	affected	< ee477e5204f764444e60699280abf5936c2a6ae6
`853a0c25baf96b028de1654bea1e0c8857eadf3d`	affected	< 11afe1912140f79d5af3091a54b181ef72fce1a5
`853a0c25baf96b028de1654bea1e0c8857eadf3d`	affected	< c4058355d27488a3cd31c60c032335f77c4fdcfc
`853a0c25baf96b028de1654bea1e0c8857eadf3d`	affected	< fb0601134c7e51728bd098abc6909315de1e5d86
`c7da4ed95a78e38fdaffb06eaf1a3f3318b1add6`	affected	—
`c005218328597211008a4d33a91e2952798e3556`	affected	—
`1357ed0b4b9db30846377febb40a847d6103c991`	affected	—
`43f4a516b2f5492bc597f3753b693ad8adc62748`	affected	—
`2.6.27.62`	affected	< 2.6.28
`2.6.32.57`	affected	< 2.6.33
`3.0.21`	affected	< 3.1
`3.2.6`	affected	< 3.3

Linux

affected

Version	Status	Constraints
`3.3`	affected	—
`0`	unaffected	< 3.3
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[853a0c25baf96b028de1654bea1e0c8857eadf3d,e6461ef34f91ad7dbffdf912b3d661a7dd892931)`	affected	code_commit	—
`[853a0c25baf96b028de1654bea1e0c8857eadf3d,359cea636f4a74a96c01a8050f155e12840c079a)`	affected	code_commit	—
`[853a0c25baf96b028de1654bea1e0c8857eadf3d,a4c4e38b356ad4c1f90478124922917489137c08)`	affected	code_commit	—
`[853a0c25baf96b028de1654bea1e0c8857eadf3d,8034ddf4751d9143c5ef7eebe3d4f33218fdd378)`	affected	code_commit	—
`[853a0c25baf96b028de1654bea1e0c8857eadf3d,ee477e5204f764444e60699280abf5936c2a6ae6)`	affected	code_commit	—
`[853a0c25baf96b028de1654bea1e0c8857eadf3d,11afe1912140f79d5af3091a54b181ef72fce1a5)`	affected	code_commit	—
`[853a0c25baf96b028de1654bea1e0c8857eadf3d,c4058355d27488a3cd31c60c032335f77c4fdcfc)`	affected	code_commit	—
`[853a0c25baf96b028de1654bea1e0c8857eadf3d,fb0601134c7e51728bd098abc6909315de1e5d86)`	affected	code_commit	—
`c7da4ed95a78e38fdaffb06eaf1a3f3318b1add6`	affected	code_commit	—
`c005218328597211008a4d33a91e2952798e3556`	affected	code_commit	—
`1357ed0b4b9db30846377febb40a847d6103c991`	affected	code_commit	—
`43f4a516b2f5492bc597f3753b693ad8adc62748`	affected	code_commit	—
`[2.6.27.62,2.6.28)`	affected	generic	—
`[2.6.32.57,2.6.33)`	affected	generic	—
`[3.0.21,3.1)`	affected	generic	—
`[3.2.6,3.3)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.3`	affected	generic	—
`[0,3.3)`	unaffected	semver	—
`[5.10.270,5.10.*]`	unaffected	generic	—
`[5.15.221,5.15.*]`	unaffected	generic	—
`[6.1.188,6.1.*]`	unaffected	generic	—
`[6.6.157,6.6.*]`	unaffected	generic	—
`[7.2.6,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—
`[6.12.110,6.12.*]`	unaffected	generic	—
`[6.18.52,6.18.*]`	unaffected	generic	—
`[6.6.157,6.6.*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the upstream patch that sets the BH_Uptodate flag for the LVID buffer before marking it dirty.
If a kernel upgrade cannot be performed immediately, monitor system logs for repeated WARN_ON_ONCE messages identifying ‘buffer_uptodate(bh)’, as these indicate underlying I/O problems that should be addressed.
Following the kernel upgrade, verify that the UDF filesystem functions correctly by attempting a write of the LVID buffer under normal conditions and confirming that no spurious warnings appear.

Generated by OpenCVE AI on September 19, 2026 at 08:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/11afe1912140f79d5af3091a54b181ef72fce1a5
https://git.kernel.org/stable/c/359cea636f4a74a96c01a8050f155e12840c079a
https://git.kernel.org/stable/c/8034ddf4751d9143c5ef7eebe3d4f33218fdd378
https://git.kernel.org/stable/c/a4c4e38b356ad4c1f90478124922917489137c08
https://git.kernel.org/stable/c/c4058355d27488a3cd31c60c032335f77c4fdcfc
https://git.kernel.org/stable/c/e6461ef34f91ad7dbffdf912b3d661a7dd892931
https://git.kernel.org/stable/c/ee477e5204f764444e60699280abf5936c2a6ae6
https://git.kernel.org/stable/c/fb0601134c7e51728bd098abc6909315de1e5d86

History

Sat, 19 Sep 2026 09:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: udf: Mark LVID buffer as uptodate before marking it dirty When an I/O error occurs while writing the Logical Volume Integrity Descriptor (LVID) buffer to the block device, the block layer's completion handler (`end_buffer_write_sync()`) clears the `BH_Uptodate` flag on the buffer. However, the buffer still contains valid LVID data in memory. If the filesystem is subsequently remounted read-write or synced, `udf_open_lvid()` or `udf_sync_fs()` will modify the LVID buffer and call `mark_buffer_dirty()`. This triggers a spurious `WARN_ON_ONCE(!buffer_uptodate(bh))` warning in `mark_buffer_dirty()` because the buffer is not marked uptodate, even though its in-memory contents are valid and are about to be overwritten. To prevent this spurious warning, unconditionally set the `BH_Uptodate` flag before calling `mark_buffer_dirty()` in `udf_open_lvid()` and `udf_sync_fs()`. This acknowledges that the in-memory buffer is valid and matches the workaround previously applied to `udf_close_lvid()` in commit 853a0c25baf9 ("udf: Mark LVID buffer as uptodate before marking it dirty"). Extending this workaround ensures consistent behavior across all LVID updates. Buffer I/O error on dev loop0, logical block 128, lost sync page write ------------[ cut here ]------------ !buffer_uptodate(bh) WARNING: fs/buffer.c:1087 at mark_buffer_dirty+0x299/0x410 fs/buffer.c:1087 ... Call Trace: <TASK> udf_open_lvid+0x369/0x5b0 fs/udf/super.c:2078 udf_reconfigure+0x336/0x540 fs/udf/super.c:679 reconfigure_super+0x232/0x8f0 fs/super.c:1080 vfs_cmd_reconfigure fs/fsopen.c:268 [inline] vfs_fsconfig_locked+0x171/0x320 fs/fsopen.c:297 __do_sys_fsconfig fs/fsopen.c:463 [inline] __se_sys_fsconfig+0x6b9/0x810 fs/fsopen.c:350 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 </TASK>
Title		udf: Mark LVID buffer as uptodate before marking it dirty
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/11afe1912140f79d5af3091a54b181ef72fce1a5 https://git.kernel.org/stable/c/359cea636f4a74a96c01a8050f155e12840c079a https://git.kernel.org/stable/c/8034ddf4751d9143c5ef7eebe3d4f33218fdd378 https://git.kernel.org/stable/c/a4c4e38b356ad4c1f90478124922917489137c08 https://git.kernel.org/stable/c/c4058355d27488a3cd31c60c032335f77c4fdcfc https://git.kernel.org/stable/c/e6461ef34f91ad7dbffdf912b3d661a7dd892931 https://git.kernel.org/stable/c/ee477e5204f764444e60699280abf5936c2a6ae6 https://git.kernel.org/stable/c/fb0601134c7e51728bd098abc6909315de1e5d86

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:11:40.099Z

Updated: 2026-09-17T16:11:40.099Z

Reserved: 2026-09-17T16:02:15.088Z

Link: CVE-2026-93140

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:18:08.973

Modified: 2026-09-17T17:18:08.973

Link: CVE-2026-93140

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T08:45:17Z

Weaknesses

CWE-665
Improper Initialization

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object