Junglewise Threat Intelligence

CVE-2026-68132: Linux kernel deadlock in emergency block device thaw

CVE-2026-68132 · Severity: info · Published 2026-08-10

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's emergency thaw mechanism for frozen block devices contains a deadlock vulnerability where a worker thread attempting to thaw a filesystem freezes against itself. This deadlock can prevent subsequent filesystem mount, unmount, freeze, or thaw operations from completing, potentially causing system hangs and operational disruptions.

Technical details

The vulnerability is a deadlock in the do_thaw_all_callback() function in the Linux kernel's superblock freeze/thaw mechanism. The root cause is that do_thaw_all_callback() acquires sb->s_umount exclusively before calling bdev_thaw(). When bdev_thaw() drops the last freeze reference, it triggers fs_bdev_thaw() which attempts to reacquire sb->s_umount via super_lock(), causing the same task to deadlock on itself. Additionally, this lock ordering (s_umount held while acquiring bd_fsfreeze_mutex) inverts the normal ordering and can cause ABBA deadlocks against concurrent freeze operations. The fix involves pinning the superblock with an active reference instead of holding s_umount, allowing bdev_thaw() to execute without the recursive lock acquisition. This vulnerability has existed for a long time but the current form dates back to an earlier commit affecting thaw_bdev().

Affected products

  • Linux Linux kernel multiple versions

Timeline

  • 2026-08-10: disclosed

Related threats