CVE-2026-97521gfs2: fix quota init duplicate scan
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: gfs2: fix quota init duplicate scan gfs2_quota_init() checks for duplicate quota_change IDs while holding qd_lock and the quota hash bucket bitlock. That path used gfs2_qd_search_bucket(), which takes a lockref reference via lockref_get_not_dead(). On PREEMPT_RT this may sleep, which is not allowed under the bucket bitlock, triggering "sleeping function called from invalid context". Use a no-ref bucket lookup in this path, then continue duplicate handling without taking a lockref there. Refactor gfs2_qd_search_bucket() to build on top of the no-ref helper so lookup traversal stays in one place. This patch fixes a bug reported by syzbot.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 28, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f before 7fdcf16e5e14e11028f5bcaa6d25075eb5e876a0; from de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f before 812a766e2b0a8f4d094393fad13475c57f5f86db; from de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f before b99a1f0f18ee50445907f55069e88bcfd8947383 | CNA record |
References
- https://git.kernel.org/stable/c/7fdcf16e5e14e11028f5bcaa6d25075eb5e876a0
- https://git.kernel.org/stable/c/812a766e2b0a8f4d094393fad13475c57f5f86db
- https://git.kernel.org/stable/c/b99a1f0f18ee50445907f55069e88bcfd8947383
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.