CVE-2026-93269ext4: fix circular lock dependency in ext4_ext_migrate
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ext4: fix circular lock dependency in ext4_ext_migrate Move iput(tmp_inode) after ext4_writepages_up_write() to avoid a circular lock dependency between s_writepages_rwsem and sb_internal (freeze protection). The deadlock scenario: CPU0 (EXT4_IOC_MIGRATE) CPU1 (orphan cleanup during mount) ---- ---- ext4_ext_migrate() ext4_writepages_down_write() s_writepages_rwsem (write) ext4_evict_inode() sb_start_intwrite() [sb_internal] ... ext4_writepages() s_writepages_rwsem (read) [BLOCKED] iput(tmp_inode) ext4_evict_inode() sb_start_intwrite() [BLOCKED] The tmp_inode is a temporary inode with nlink=0 created solely for building the extent tree. Its eviction does not require s_writepages_rwsem protection, so deferring iput() until after releasing the rwsem is safe.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 24, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from cb85f4d23f794e24127f3e562cb3b54b0803f456 before 452950461241dfed8b1d32e94b227db38c99c5af; from cb85f4d23f794e24127f3e562cb3b54b0803f456 before ada23457d4748d6e9c36c6f871fc29a6f558c48c; from cb85f4d23f794e24127f3e562cb3b54b0803f456 before e4223231b6860141813637a6413c2371ae4d6fa8; from cb85f4d23f794e24127f3e562cb3b54b0803f456 before 32f7ab52875ec7f800ca67e7176e5743a84baddf; from cb85f4d23f794e24127f3e562cb3b54b0803f456 before a897682793eba5de51ee6f3152760374afa629cf; eb799e163dc2bc1ea0a4820b66f79d32a5e907df; bcc1eab71a67c46b9e24544ac7923f44444174ce; 8cf20fb73e73a4c4df0328b5297842c5ef34fdd9; and 7 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/452950461241dfed8b1d32e94b227db38c99c5af
- https://git.kernel.org/stable/c/ada23457d4748d6e9c36c6f871fc29a6f558c48c
- https://git.kernel.org/stable/c/e4223231b6860141813637a6413c2371ae4d6fa8
- https://git.kernel.org/stable/c/32f7ab52875ec7f800ca67e7176e5743a84baddf
- https://git.kernel.org/stable/c/a897682793eba5de51ee6f3152760374afa629cf
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.