Executive brief
The Linux kernel's XFS filesystem contains a locking bug in the directory tree repair code. When a directory refers to itself (a rare edge case), the repair function attempts to acquire the same lock twice on the same inode, which can cause a system hang or deadlock. This affects systems using XFS filesystems that trigger the directory tree scrubber repair logic.
Technical details
The vulnerability is a double-lock issue (resource deadlock) in the XFS directory tree repair code (fs/xfs/scrub/dirtree_repair.c). When the dirtree scrubber detects a self-referential directory (where sc->ip equals dp), the repair code attempts to acquire XFS_IOLOCK_EXCL and XFS_ILOCK_EXCL locks on both sc->ip and dp without first checking if they are the same inode. Since both variables reference the same inode object, attempting to lock it twice causes a deadlock. The fix adds conditional checks to skip the second lock acquisition and uses the appropriate single-inode transaction allocation path when sc->ip == dp. The vulnerability was introduced in kernel v6.10 and requires the dirtree scrubber to detect the self-referential condition to be triggered.
Affected products
- Linux Linux kernel v6.10 and later
Timeline
- 2026-08-26: disclosed
- 2026-07-26: patched