CVE-2026-93252 - Vulnerability Details

- ocfs2: fix circular locking dependency in ocfs2_init_acl()

Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix circular locking dependency in ocfs2_init_acl()

A lockdep warning indicates a circular locking dependency between
`&oi->ip_xattr_sem` and `&journal->j_trans_barrier`:

WARNING: possible circular locking dependency detected
is trying to acquire lock:
(&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0
fs/ocfs2/acl.c:367

but task is already holding lock:
(&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700
fs/ocfs2/journal.c:369

The deadlock involves two code paths: Path 1 (setxattr) where
`ocfs2_xattr_set()` acquires `ip_xattr_sem` (write) and then starts a
transaction, which acquires `j_trans_barrier` (read); and Path 2
(mkdir/mknod) where `ocfs2_mknod()` starts a transaction (`j_trans_barrier`
read) and then calls `ocfs2_init_acl()`, which attempts to acquire
`ip_xattr_sem` (read) on the parent directory to retrieve the default ACL.

Because rw_semaphores are subject to writer priority, a pending writer on
`j_trans_barrier` (e.g., the journal commit thread) can cause Path 1 to
block, while Path 2 is blocked waiting for Path 1 to release
`ip_xattr_sem`.

The patch fixes the lock ordering by precomputing the ACL state before
starting the OCFS2 transaction, while preserving POSIX ACL storage
semantics and the existing inode/security initialization order. By reading
the parent directory's default ACL and preparing the new inode's ACLs
outside the transaction, `ip_xattr_sem` is always acquired before
`j_trans_barrier`.

`struct ocfs2_acl_state` encapsulates the prepared ACL state, while
`ocfs2_acl_init_prepare()` and `ocfs2_acl_init_release()` avoid code
duplication between `ocfs2_mknod()` and `ocfs2_init_security_and_acl()`.
`ocfs2_calc_xattr_init()` and `ocfs2_init_acl()` use this precomputed
state, removing internal `ip_xattr_sem` acquisition and redundant disk
reads.

Additionally, remove the `ip_xattr_sem` acquisition from
`ocfs2_xattr_set_handle()`. This function is only used while initializing a
new inode that has not yet been inserted into the inode hash or attached to
a dentry, meaning there is no risk of concurrent access and the lock is
unnecessary.

Published: 2026-09-24

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug introduces a circular locking dependency between the inode attribute semaphore and the journal transaction barrier. When operations such as setxattr, mkdir, or mknod acquire these locks in alternating order, a deadlock can occur, leading to a kernel freeze or loss of availability. No known remote exploitation vectors exist; the issue is local and triggered by file system activity.

Affected Systems

Any Linux kernel that includes OCFS2 before the patch. The vulnerability exists in the OCFS2 file system implementation of the kernel, as indicated by the CPE for the Linux kernel. No specific version range is provided, so all releases before the fix are potentially affected.

Risk and Exploitability

EPSS information is unavailable and the vulnerability is not listed in CISA KEV. The CVSS score is not supplied, but the nature of the bug suggests a moderate to high impact if exploited locally, as it can arrest system operations. Because the exploit requires concurrent conflicting file system operations, it is limited to environments that use OCFS2 file systems and may be mitigated by restricting such activity until the kernel can be updated.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`16c8d569f5704a84164f30ff01b29879f3438065`	affected	< 4936d4464d1ae10b5fbba64374085a0dcc060560
`16c8d569f5704a84164f30ff01b29879f3438065`	affected	< caf3056936fb8b5ce92e419cf8b246ce9c437343
`16c8d569f5704a84164f30ff01b29879f3438065`	affected	< 5b7b3c50c39ad0dc27e7418981e01c4183273f89
`16c8d569f5704a84164f30ff01b29879f3438065`	affected	< 8d88f52fbbbcc18adf4091a955511d0cf605bf11
`16c8d569f5704a84164f30ff01b29879f3438065`	affected	< 8931403ee3dcfe8a24a5267efec9d9460ab7a1b5
`16c8d569f5704a84164f30ff01b29879f3438065`	affected	< f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758
`16c8d569f5704a84164f30ff01b29879f3438065`	affected	< 1222f7a3183b35c0c566899fdaead5c7c4043076
`16c8d569f5704a84164f30ff01b29879f3438065`	affected	< bd7c05fb4a4776dff5a87b19008d28458647d15d
`15ac59a84750b3afc0a2b6f2636c4f7e6cbd6d5e`	affected	—
`b35bb8a41795caa05e09c3aacf7d78f1f20bac04`	affected	—
`1d5fdc1307eeb04b334c5dc23e11dbd6068d90eb`	affected	—
`a66174eb4a149b7919d174d9a7ce6ad9909c5ee2`	affected	—
`3.18.111`	affected	< 3.19
`4.4.134`	affected	< 4.5
`4.9.104`	affected	< 4.10
`4.14.37`	affected	< 4.15

Linux

affected

Version	Status	Constraints
`4.16`	affected	—
`0`	unaffected	< 4.16
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[16c8d569f5704a84164f30ff01b29879f3438065,4936d4464d1ae10b5fbba64374085a0dcc060560)`	affected	code_commit	—
`[16c8d569f5704a84164f30ff01b29879f3438065,caf3056936fb8b5ce92e419cf8b246ce9c437343)`	affected	code_commit	—
`[16c8d569f5704a84164f30ff01b29879f3438065,5b7b3c50c39ad0dc27e7418981e01c4183273f89)`	affected	code_commit	—
`[16c8d569f5704a84164f30ff01b29879f3438065,8d88f52fbbbcc18adf4091a955511d0cf605bf11)`	affected	code_commit	—
`[16c8d569f5704a84164f30ff01b29879f3438065,8931403ee3dcfe8a24a5267efec9d9460ab7a1b5)`	affected	code_commit	—
`[16c8d569f5704a84164f30ff01b29879f3438065,f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758)`	affected	code_commit	—
`[16c8d569f5704a84164f30ff01b29879f3438065,1222f7a3183b35c0c566899fdaead5c7c4043076)`	affected	code_commit	—
`[16c8d569f5704a84164f30ff01b29879f3438065,bd7c05fb4a4776dff5a87b19008d28458647d15d)`	affected	code_commit	—
`15ac59a84750b3afc0a2b6f2636c4f7e6cbd6d5e`	affected	code_commit	—
`b35bb8a41795caa05e09c3aacf7d78f1f20bac04`	affected	code_commit	—
`1d5fdc1307eeb04b334c5dc23e11dbd6068d90eb`	affected	code_commit	—
`a66174eb4a149b7919d174d9a7ce6ad9909c5ee2`	affected	code_commit	—
`[3.18.111,3.19)`	affected	semver	—
`[4.4.134,4.5)`	affected	semver	—
`[4.9.104,4.10)`	affected	semver	—
`[4.14.37,4.15)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.16`	affected	generic	—
`[0,4.16)`	unaffected	generic	—
`[5.10.270,5.10.*]`	unaffected	generic	—
`[5.15.221,5.15.*]`	unaffected	generic	—
`[6.1.188,6.1.*]`	unaffected	generic	—
`[6.6.157,6.6.*]`	unaffected	generic	—
`[6.12.110,6.12.*]`	unaffected	generic	—
`[6.18.52,6.18.*]`	unaffected	generic	—
`[7.2.6,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that contains the fixed ocfs2_init_acl implementation.
If an immediate upgrade is not possible, disable or remove OCFS2 mounts from machines until the patch is applied.
Keep kernel lockdep enabled and monitor for lockdep warnings; if a warning appears, isolate the OCFS2 volume and evacuate critical workloads until the issue is resolved.

Generated by OpenCVE AI on September 25, 2026 at 10:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00211.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1222f7a3183b35c0c566899fdaead5c7c4043076
https://git.kernel.org/stable/c/4936d4464d1ae10b5fbba64374085a0dcc060560
https://git.kernel.org/stable/c/5b7b3c50c39ad0dc27e7418981e01c4183273f89
https://git.kernel.org/stable/c/8931403ee3dcfe8a24a5267efec9d9460ab7a1b5
https://git.kernel.org/stable/c/8d88f52fbbbcc18adf4091a955511d0cf605bf11
https://git.kernel.org/stable/c/bd7c05fb4a4776dff5a87b19008d28458647d15d
https://git.kernel.org/stable/c/caf3056936fb8b5ce92e419cf8b246ce9c437343
https://git.kernel.org/stable/c/f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758

History

Fri, 25 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-762

Thu, 24 Sep 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2_init_acl() A lockdep warning indicates a circular locking dependency between `&oi->ip_xattr_sem` and `&journal->j_trans_barrier`: WARNING: possible circular locking dependency detected is trying to acquire lock: (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0 fs/ocfs2/acl.c:367 but task is already holding lock: (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700 fs/ocfs2/journal.c:369 The deadlock involves two code paths: Path 1 (setxattr) where `ocfs2_xattr_set()` acquires `ip_xattr_sem` (write) and then starts a transaction, which acquires `j_trans_barrier` (read); and Path 2 (mkdir/mknod) where `ocfs2_mknod()` starts a transaction (`j_trans_barrier` read) and then calls `ocfs2_init_acl()`, which attempts to acquire `ip_xattr_sem` (read) on the parent directory to retrieve the default ACL. Because rw_semaphores are subject to writer priority, a pending writer on `j_trans_barrier` (e.g., the journal commit thread) can cause Path 1 to block, while Path 2 is blocked waiting for Path 1 to release `ip_xattr_sem`. The patch fixes the lock ordering by precomputing the ACL state before starting the OCFS2 transaction, while preserving POSIX ACL storage semantics and the existing inode/security initialization order. By reading the parent directory's default ACL and preparing the new inode's ACLs outside the transaction, `ip_xattr_sem` is always acquired before `j_trans_barrier`. `struct ocfs2_acl_state` encapsulates the prepared ACL state, while `ocfs2_acl_init_prepare()` and `ocfs2_acl_init_release()` avoid code duplication between `ocfs2_mknod()` and `ocfs2_init_security_and_acl()`. `ocfs2_calc_xattr_init()` and `ocfs2_init_acl()` use this precomputed state, removing internal `ip_xattr_sem` acquisition and redundant disk reads. Additionally, remove the `ip_xattr_sem` acquisition from `ocfs2_xattr_set_handle()`. This function is only used while initializing a new inode that has not yet been inserted into the inode hash or attached to a dentry, meaning there is no risk of concurrent access and the lock is unnecessary.
Title		ocfs2: fix circular locking dependency in ocfs2_init_acl()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1222f7a3183b35c0c566899fdaead5c7c4043076 https://git.kernel.org/stable/c/4936d4464d1ae10b5fbba64374085a0dcc060560 https://git.kernel.org/stable/c/5b7b3c50c39ad0dc27e7418981e01c4183273f89 https://git.kernel.org/stable/c/8931403ee3dcfe8a24a5267efec9d9460ab7a1b5 https://git.kernel.org/stable/c/8d88f52fbbbcc18adf4091a955511d0cf605bf11 https://git.kernel.org/stable/c/bd7c05fb4a4776dff5a87b19008d28458647d15d https://git.kernel.org/stable/c/caf3056936fb8b5ce92e419cf8b246ce9c437343 https://git.kernel.org/stable/c/f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T15:51:28.355Z

Updated: 2026-09-24T15:51:28.355Z

Reserved: 2026-09-17T16:02:15.096Z

Link: CVE-2026-93252

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T16:17:21.463

Modified: 2026-09-24T16:17:21.463

Link: CVE-2026-93252

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-25T10:30:10Z

Weaknesses

CWE-762
Mismatched Memory Management Routines

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object