Executive brief
The Linux kernel's NTFS file system implementation contains a deadlock condition in its write-back mechanism that can be triggered when the system attempts to simultaneously write inode and file metadata. This deadlock can cause system hangs or service interruptions affecting any server or system using NTFS volumes for storage.
Technical details
This vulnerability is an ABBA (Circular) deadlock in the Linux kernel's NTFS driver between the extent_lock and extent mrec_lock (MFT record lock) acquired during inode writeback. The deadlock occurs in two competing code paths: Path A acquires extent_lock then mrec_lock during inode writeback (__ntfs_write_inode), while Path B acquires mrec_lock then attempts to acquire extent_lock during MFT folio writeback (ntfs_write_mft_block). The issue was introduced by commit 6994acf33bae and was discovered via xfstests generic/113. The fix removes redundant lock acquisition from the MFT folio writeback path, as normal extent record modifications are always handled through the inode writeback path (Path A). No authentication or special privileges are required to trigger this condition; any activity causing extent record modification followed by MFT writeback can trigger the deadlock. The patch has been applied to the upstream kernel.
Affected products
- Linux Linux kernel since commit 6994acf33bae (affected version range not specified in advisory)
Timeline
- 2026-08-15: disclosed
- 2026-08-15: patched