{"id":"CVE-2026-99132","revision":"8e402bb65f894385b34beada74294655","records":[{"revision":"8e402bb65f894385b34beada74294655","observedAt":"2026-10-28T11:27:43.363+00:00","statement":{"source":"cve-program","id":"CVE-2026-99132","aliases":[],"title":"xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf\n\nxfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous\nxfs_trans_commit(), which flushes the CIL push workqueue internally.\nIf shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to\nlock these buffers to fail them, causing a deadlock:\n\n  setlabel:          holds buf lock -> flush_workqueue(xfs-cil)\n  CIL push worker:   xfs_buf_item_unpin -> xfs_buf_lock(same buf)\n\nRemove the xfs_trans_bhold() calls so that commit releases the buffer\nlocks normally.  After the sync commit, re-acquire the buffers via\nmp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.","state":0,"publishedAt":"2026-10-28T10:34:45.756+00:00","modifiedAt":"2026-10-28T10:34:45.756+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/xfs/libxfs/xfs_rtgroup.h\",\n                        \"fs/xfs/libxfs/xfs_sb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f7664b31975bd893190708e76b2c424328f0c49b\",\n                            \"lessThan\": \"e5456dec79c71c8ef8f9f9adb77d320f113b34db\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f7664b31975bd893190708e76b2c424328f0c49b\",\n                            \"lessThan\": \"6353e5cd8c43d6e805cacbfbfecf4103571a7ff8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f7664b31975bd893190708e76b2c424328f0c49b\",\n                            \"lessThan\": \"41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/xfs/libxfs/xfs_rtgroup.h\",\n                        \"fs/xfs/libxfs/xfs_sb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e5456dec79c71c8ef8f9f9adb77d320f113b34db","https://git.kernel.org/stable/c/6353e5cd8c43d6e805cacbfbfecf4103571a7ff8","https://git.kernel.org/stable/c/41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99132","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99132","identifiers":["CVE-2026-99132"]},"retained":false,"historicalAffected":[]}],"coverage":[]}