Executive brief
The Linux kernel's XFS filesystem includes an online file system checker (fsck) that can become stuck in an infinite loop if the unlinked inode list contains a circular reference. This can cause the system to become unresponsive when filesystem maintenance is performed. The fix adds cycle detection to prevent the livelock.
Technical details
The vulnerability is a denial-of-service livelock in the XFS online filesystem scrub functionality. The root cause is insufficient cycle detection in the unlinked inode list traversal code (fs/xfs/scrub/agheader.c). When walking the unlinked inode list during AGI (allocation group inode) scrub, if a circular reference exists in the list, the code would enter an infinite loop. The fix uses a bitmap-based cycle detector (xagino_bitmap) to track seen inode numbers and detect loops before they cause a livelock. The vulnerability affects the online fsck path which is network-reachable on systems where online scrubbing is enabled, but requires access to trigger filesystem checks. The patch has been applied to stable kernel versions v4.15 and later.
Affected products
- Linux Linux kernel v4.15 and later (prior to patch)
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched: Stable kernel patch committed