CVE-2026-93252

CVE CVE-2026-93252EUVD EUVD-2026-86124Published 2026-09-24T15:51:28.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2_init_acl() A lockdep warning indicates a circular locking dependency between `&oi->ip_xattr_sem` and `&journal->j_trans_barrier`: WARNING: possible circular locking dependency detected is trying to acquire lock: (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0 fs/ocfs2/acl.c:367 but task is already holding lock: (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700 fs/ocfs2/journal.c:369 The deadlock involves two code paths: Path 1 (setxattr) where `ocfs2_xattr_set()` acquires `ip_xattr_sem` (write) and then starts a transaction, which acquires `j_trans_barrier` (read); and Path 2 (mkdir/mknod) where `ocfs2_mknod()` starts a transaction (`j_trans_barrier` read) and then calls `ocfs2_init_acl()`, which attempts to acquire `ip_xattr_sem` (read) on the parent directory to retrieve the default ACL. Because rw_semaphores are subject to writer priority, a pending writer on `j_trans_barrier` (e.g., the journal commit thread) can cause Path 1 to block, while Path 2 is blocked waiting for Path 1 to release `ip_xattr_sem`. The patch fixes the lock ordering by precomputing the ACL state before starting the OCFS2 transaction, while preserving POSIX ACL storage semantics and the existing inode/security initialization order. By reading the parent directory's default ACL and preparing the new inode's ACLs outside the transaction, `ip_xattr_sem` is always acquired before `j_trans_barrier`. `struct ocfs2_acl_state` encapsulates the prepared ACL state, while `ocfs2_acl_init_prepare()` and `ocfs2_acl_init_release()` avoid code duplication between `ocfs2_mknod()` and `ocfs2_init_security_and_acl()`. `ocfs2_calc_xattr_init()` and `ocfs2_init_acl()` use this precomputed state, removing internal `ip_xattr_sem` acquisition and redundant disk reads. Additionally, remove the `ip_xattr_sem` acquisition from `ocfs2_xattr_set_handle()`. This function is only used while initializing a new inode that has not yet been inserted into the inode hash or attached to a dentry, meaning there is no risk of concurrent access and the lock is unnecessary.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 6.18.52; patch: 7.3-rc1; 1d5fdc1307eeb04b334c5dc23e11dbd6068d90eb; 16c8d569f5704a84164f30ff01b29879f3438065 <f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758; a66174eb4a149b7919d174d9a7ce6ad9909c5ee2; 4.16; 16c8d569f5704a84164f30ff01b29879f3438065 <8931403ee3dcfe8a24a5267efec9d9460ab7a1b5; b35bb8a41795caa05e09c3aacf7d78f1f20bac04; 16c8d569f5704a84164f30ff01b29879f3438065 <caf3056936fb8b5ce92e419cf8b246ce9c437343; patch: 5.15.221; patch: 0; patch: 6.12.110; 4.9.104 <4.10; 16c8d569f5704a84164f30ff01b29879f3438065 <1222f7a3183b35c0c566899fdaead5c7c4043076; 3.18.111 <3.19; patch: 6.1.188; 4.14.37 <4.15; 16c8d569f5704a84164f30ff01b29879f3438065 <4936d4464d1ae10b5fbba64374085a0dcc060560; 16c8d569f5704a84164f30ff01b29879f3438065 <5b7b3c50c39ad0dc27e7418981e01c4183273f89; 16c8d569f5704a84164f30ff01b29879f3438065 <bd7c05fb4a4776dff5a87b19008d28458647d15d; patch: 7.2.6; patch: 5.10.270; 15ac59a84750b3afc0a2b6f2636c4f7e6cbd6d5e; patch: 6.6.157; 16c8d569f5704a84164f30ff01b29879f3438065 <8d88f52fbbbcc18adf4091a955511d0cf605bf11; 4.4.134 <4.5

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.