PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45895 Linux CVE debrief

A livelock vulnerability exists in the Linux kernel's quota subsystem that can cause system hangs when filesystem freeze operations and quota control operations execute concurrently on non-preemptible kernels. The issue occurs in quotactl_block() when it enters a retry loop waiting for a frozen filesystem to thaw. On kernels with preemption disabled, this loop lacks scheduling points, preventing the CPU from reaching an RCU quiescent state. This blocks synchronize_rcu() in the freezer's percpu_down_write() call, creating a circular wait: the quota process spins indefinitely waiting for the freezer to advance, while the freezer waits indefinitely for the quota process's CPU to report quiescence. The vulnerability results in 100% CPU usage by the quota process and complete hang of the freezer process. The fix adds cond_resched() to the retry loop, providing an RCU quiescent state that allows synchronize_rcu() to complete. This vulnerability affects systems running quota operations on frozen filesystems, particularly single-CPU or CPU-pinned workloads where the freezer and quota operations share a CPU.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Linux system administrators running filesystem quota management alongside backup or maintenance operations that freeze filesystems; kernel maintainers and distributors; organizations using CPU pinning or single-core configurations for I/O-intensive workloads

Technical summary

The vulnerability is a livelock in fs/quota/quota.c's quotactl_block() function. When a filesystem is frozen via freeze_super(), quotactl_block() spins in a retry loop acquiring s_umount, checking freeze state, dropping s_umount, and using sb_start_write()/sb_end_write() to wait. On non-preemptible kernels, this tight loop never yields, preventing RCU quiescence. The freezer's sb_wait_write() → percpu_down_write() → synchronize_rcu() chain stalls waiting for the quota CPU, while the quota CPU stalls waiting for the freezer. The fix inserts cond_resched() into the retry loop, explicitly yielding and providing an RCU quiescent state. Multiple stable kernel branches received backports of this fix.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable tree commits resolving the livelock condition
  • Prioritize patching systems running quota operations with filesystem freeze/thaw cycles
  • Monitor for hung freezer processes or sustained 100% CPU usage in quota-related kernel threads
  • Consider avoiding concurrent quota and freeze operations on single-CPU or CPU-pinned workloads until patched
  • Review kernel preemption configuration; non-preemptible kernels are more susceptible to this livelock

Evidence notes

Vulnerability description sourced from official CVE record published 2026-05-27. Root cause identified as missing scheduling point in quotactl_block() retry loop. Fix confirmed via kernel.org stable tree commits adding cond_resched(). Reproduction scenario documented using xfs_freeze and quotaon/quotaoff on pinned CPU.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45895 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45895

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45895 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45895

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/02bb1500f1479750e6557c8044f6a2d7e9d30c12

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/37ccd48cf35f3c8b9f2ea961a7b486b91eb71a82

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/414259caf81a397563fc9baca9c0ef856c4a97cf

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/53b2314b26b6640a3657cc924de63a1a8f26ac4d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/77449e453dfc006ad738dec55374c4cbc056fd39

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.