{"id":"CVE-2026-99132","revision":"fdbd7c2c81404bd7ab4bbb9d2193e3b8","records":[{"revision":"fdbd7c2c81404bd7ab4bbb9d2193e3b8","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2026-99132","aliases":[],"title":"xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf\n\nxfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous\nxfs_trans_commit(), which flushes the CIL push workqueue internally.\nIf shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to\nlock these buffers to fail them, causing a deadlock:\n\n  setlabel:          holds buf lock -> flush_workqueue(xfs-cil)\n  CIL push worker:   xfs_buf_item_unpin -> xfs_buf_lock(same buf)\n\nRemove the xfs_trans_bhold() calls so that commit releases the buffer\nlocks normally.  After the sync commit, re-acquire the buffers via\nmp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.","state":0,"publishedAt":"2026-10-28T10:34:45.756+00:00","modifiedAt":"2026-10-30T12:42:05.352+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/xfs/libxfs/xfs_rtgroup.h\",\n                        \"fs/xfs/libxfs/xfs_sb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f7664b31975bd893190708e76b2c424328f0c49b\",\n                            \"lessThan\": \"16468281da17263095bd1906cf2d16a972f10791\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f7664b31975bd893190708e76b2c424328f0c49b\",\n                            \"lessThan\": \"45f124f3902bfae6a366d124db04f707264176fb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f7664b31975bd893190708e76b2c424328f0c49b\",\n                            \"lessThan\": \"d900946853c2d183fa0e199bae9ddbcd21795a18\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f7664b31975bd893190708e76b2c424328f0c49b\",\n                            \"lessThan\": \"83b2e511cf9ba22904b167e00fcbd85169b50b2c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f7664b31975bd893190708e76b2c424328f0c49b\",\n                            \"lessThan\": \"acd7f2f9b822b6e126f3e3c99c173e62aa315b6f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f7664b31975bd893190708e76b2c424328f0c49b\",\n                            \"lessThan\": \"e5456dec79c71c8ef8f9f9adb77d320f113b34db\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f7664b31975bd893190708e76b2c424328f0c49b\",\n                            \"lessThan\": \"6353e5cd8c43d6e805cacbfbfecf4103571a7ff8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f7664b31975bd893190708e76b2c424328f0c49b\",\n                            \"lessThan\": \"41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/xfs/libxfs/xfs_rtgroup.h\",\n                        \"fs/xfs/libxfs/xfs_sb.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.273\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.224\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.161\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.115\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/16468281da17263095bd1906cf2d16a972f10791","https://git.kernel.org/stable/c/45f124f3902bfae6a366d124db04f707264176fb","https://git.kernel.org/stable/c/d900946853c2d183fa0e199bae9ddbcd21795a18","https://git.kernel.org/stable/c/83b2e511cf9ba22904b167e00fcbd85169b50b2c","https://git.kernel.org/stable/c/acd7f2f9b822b6e126f3e3c99c173e62aa315b6f","https://git.kernel.org/stable/c/e5456dec79c71c8ef8f9f9adb77d320f113b34db","https://git.kernel.org/stable/c/6353e5cd8c43d6e805cacbfbfecf4103571a7ff8","https://git.kernel.org/stable/c/41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99132","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99132","identifiers":["CVE-2026-99132"]},"retained":false,"historicalAffected":[]}],"coverage":[]}