Executive brief
A flaw in the Linux kernel's journaling block device (jbd2) can cause a system hang or deadlock. This component is responsible for ensuring file system integrity during crashes. If triggered, the system may become unresponsive, potentially leading to a denial of service and requiring a hard reboot.
Technical details
A deadlock exists in jbd2_journal_cancel_revoke() due to improper lock ordering between folio and buffer locks. The issue was introduced when the component was updated to use __find_get_block_nonatomic(), which acquires a folio lock while a buffer lock is already held. This creates an ABBA deadlock scenario during specific filesystem operations (like ext4_mkdir) when the filesystem blocksize is less than the system pagesize. An attacker or a specific sequence of system events can trigger this hang, resulting in a local denial of service. The fix involves restricting the call to __find_get_block_nonatomic() to cases where the buffer_head does not belong to the block device.
Affected products
- Linux Linux kernel f76d4c28a46a and later
Timeline
- 2026-04-09: patched: Initial fix authored by Zhang Yi
- 2026-05-27: disclosed: CVE-2026-46061 published