Executive brief
The Linux kernel's NTFS file system implementation has a deadlock vulnerability that occurs when the filesystem is being shut down. During shutdown, a race condition can cause the kernel to wait indefinitely for itself to finish an operation, freezing the system. This affects systems using NTFS partitions and can result in system hangs during shutdown or unmount operations.
Technical details
The vulnerability is a deadlock (CWE-406) in the NTFS attribute list update code. During filesystem teardown, generic_shutdown_super() clears SB_ACTIVE before evicting cached inodes. If eviction triggers ntfs_attrlist_update() via writeback of a base inode, the function unconditionally calls ntfs_attr_iget() to retrieve an attribute-list fake inode that is already in I_FREEING state. The VFS layer then waits for eviction of this inode to complete, but the current task is already inside that eviction path, causing self-deadlock in find_inode(). The fix adds a guard check: if SB_ACTIVE is cleared, ntfs_attrlist_update() returns -EIO instead of attempting the lookup. Attack vector is local only (filesystem shutdown); no network accessibility or special privileges required beyond filesystem access.
Affected products
- Linux Linux Kernel Multiple versions prior to fix commit 0ebe8f625ab0520217a425d7cd366e4670484941
Timeline
- 2026-08-15: disclosed
- 2026-07-06: patched