Executive brief
The XFS file system component in the Linux kernel contains a resource leak bug in its quota management code. When a quota operation encounters an error while reading file extent data, it fails to release an internal lock (ilock), causing that lock to remain held indefinitely. This can cause subsequent quota operations to hang or freeze, potentially leading to system performance degradation or application hangs.
Technical details
The vulnerability is a resource leak in the xfs_dq_get_next_id() function in fs/xfs/xfs_dquot.c. The function acquires a quota inode ILOCK via xfs_ilock_data_map_shared() and then calls xfs_iread_extents() to read file extent information. If xfs_iread_extents() fails and returns an error, the function exits immediately by returning the error code without releasing the previously acquired lock. This causes the quota inode to remain locked indefinitely, blocking any subsequent operations that require the same lock. The fix adds a common unlock path (out_unlock label) that ensures xfs_iunlock() is always called before returning, regardless of success or failure. The vulnerability affects Linux kernel versions from v4.12 onward where the vulnerable code was introduced.
Affected products
- Linux Linux kernel v4.12 and later
Timeline
- 2026-08-26: disclosed
- 2026-07-27: patched