Strix
73.2K

CVE-2026-99132

UnknownEPSS 0.17%

Last modified

CVE-2026-99132 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), which flushes the CIL push workqueue internally. If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to lock these buffers to fail them, causing a deadlock: setlabel: holds buf lock -> flush_workqueue(xfs-cil) CIL push worker: xfs_buf_item_unpin -> xfs_buf_lock(same buf) Remove the xfs_trans_bhold() calls so that commit releases the buffer locks normally. After the sync commit, re-acquire the buffers via mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), which flushes the CIL push workqueue internally. If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to lock these buffers to fail them, causing a deadlock: setlabel: holds buf lock -> flush_workqueue(xfs-cil) CIL push worker: xfs_buf_item_unpin -> xfs_buf_lock(same buf) Remove the xfs_trans_bhold() calls so that commit releases the buffer locks normally. After the sync commit, re-acquire the buffers via mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.

Metrics

EPSS Probability
0.17%

5.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= f7664b31975bd893190708e76b2c424328f0c49b, < 16468281da17263095bd1906cf2d16a972f10791; >= f7664b31975bd893190708e76b2c424328f0c49b, < 45f124f3902bfae6a366d124db04f707264176fb; >= f7664b31975bd893190708e76b2c424328f0c49b, < d900946853c2d183fa0e199bae9ddbcd21795a18; >= f7664b31975bd893190708e76b2c424328f0c49b, < 83b2e511cf9ba22904b167e00fcbd85169b50b2c; >= f7664b31975bd893190708e76b2c424328f0c49b, < acd7f2f9b822b6e126f3e3c99c173e62aa315b6f; >= f7664b31975bd893190708e76b2c424328f0c49b, < e5456dec79c71c8ef8f9f9adb77d320f113b34db; >= f7664b31975bd893190708e76b2c424328f0c49b, < 6353e5cd8c43d6e805cacbfbfecf4103571a7ff8; >= f7664b31975bd893190708e76b2c424328f0c49b, < 41a28c865d1d5843f8cb9e0af17a8f4d9e2961ff
LinuxLinux4.18

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-99132?
In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), which flushes the CIL push workqueue internally. If shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to lock these buffers to fail them, causing a deadlock: setlabel: holds buf lock -> flush_workqueue(xfs-cil) CIL push worker: xfs_buf_item_unpin -> xfs_buf_lock(same buf) Remove the xfs_trans_bhold() calls so that commit releases the buffer locks normally. After the sync commit, re-acquire the buffers via mp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.
How severe is CVE-2026-99132?
Severity scoring for CVE-2026-99132 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-99132?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-99132?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST