Executive brief
The XFS file system implementation in the Linux kernel contains a logic error in transaction rollback that can cause a circular lock dependency. When a transaction commit fails, the memory allocation protection context is not restored properly on the error path, creating conditions where the system can deadlock between file locking and memory reclaim operations. This can cause the system to hang or become unresponsive during file system operations.
Technical details
The vulnerability is a logic error (CWE-667: Improper Locking) in the xfs_trans_roll() function in fs/xfs/xfs_trans.c. When __xfs_trans_commit() fails, the NOFS (No File System) memory allocation context is cleared but only restored in the success path, leaving the error path without NOFS protection. This creates a circular lock dependency between xfs_nondir_ilock_class (inode lock) and fs_reclaim (memory reclaim), where CPU0 holds an inode lock while trying to acquire fs_reclaim, and CPU1 holds fs_reclaim while trying to acquire the inode lock. The fix moves xfs_trans_set_context() before the error check to ensure NOFS context is always restored. The vulnerability affects all Linux kernel versions with XFS support. A patch has been committed upstream and backported to stable kernel branches.
Affected products
- Linux Linux kernel all versions with XFS file system support
Timeline
- 2026-09-04: disclosed: Published on NVD
- 2026-07-30: patched: Fix committed upstream by Yun Zhou
- 2026-08-10: patched: Merged by Carlos Maiolino
- 2026-08-27: patched: Backported to stable kernels by Greg Kroah-Hartman