Executive brief
The Linux kernel's emergency thaw mechanism for frozen block devices contains a deadlock vulnerability where a worker thread attempting to thaw a filesystem freezes against itself. This deadlock can prevent subsequent filesystem mount, unmount, freeze, or thaw operations from completing, potentially causing system hangs and operational disruptions.
Technical details
The vulnerability is a deadlock in the do_thaw_all_callback() function in the Linux kernel's superblock freeze/thaw mechanism. The root cause is that do_thaw_all_callback() acquires sb->s_umount exclusively before calling bdev_thaw(). When bdev_thaw() drops the last freeze reference, it triggers fs_bdev_thaw() which attempts to reacquire sb->s_umount via super_lock(), causing the same task to deadlock on itself. Additionally, this lock ordering (s_umount held while acquiring bd_fsfreeze_mutex) inverts the normal ordering and can cause ABBA deadlocks against concurrent freeze operations. The fix involves pinning the superblock with an active reference instead of holding s_umount, allowing bdev_thaw() to execute without the recursive lock acquisition. This vulnerability has existed for a long time but the current form dates back to an earlier commit affecting thaw_bdev().
Affected products
- Linux Linux kernel multiple versions
Timeline
- 2026-08-10: disclosed