Executive brief
A race condition was identified in the Linux kernel's disk quota management system. This component is responsible for limiting the amount of disk space users or groups can consume. Under specific conditions, such as high memory pressure, this flaw could cause the system to crash or behave unpredictably, potentially impacting system availability and operational stability.
Technical details
A race condition exists in fs/quota/dquot.c where dquot_scan_active() can encounter a dquot that is in the process of being released by quota_release_workfn(). Specifically, CPU1 (dquot_scan_active) may find a dquot on the in-use list and increment its reference count after CPU0 (quota_release_workfn) has already moved it to a releasing list but before it has been fully deactivated. Under memory pressure, this can result in the kernel operating on a freed dquot structure. The fix ensures that dquots are properly removed from the releasing list when a new reference is acquired via __dqgrab().
Affected products
- Linux Linux Kernel versions including 22c06bf1f99ec3ec16b1a81342becba4c59a1f16, 56e96b38d2f7cd95b3c30eb70decac7233915e0a, 12a820a9923c11e8e898da9f82c8aded70cdcd16, 869b6ea1609f655a43251bf41757aa44e5350a8f
Timeline
- 2026-02-27: other: Patch authored by Jan Kara
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2bdc80f4619411e5bd4a3ef23f51e14021ed457c
- https://git.kernel.org/stable/c/61e25f664dc2a08299e07d84c85776abc2350f75
- https://git.kernel.org/stable/c/6678dde265708003c2b42551af4a2e3cb05decd5
- https://git.kernel.org/stable/c/82cbdb4c1ebb5ea7d7bd45c18d3483b5bd32ebc1
- https://git.kernel.org/stable/c/ac8a2e0d287ebf35e5d7e51e260b4e146648ba4a
- https://git.kernel.org/stable/c/e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d
- https://git.kernel.org/stable/c/f9438cb8c8ec3adc84b2b450a3aab0123d074c3b