PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45895 Linux CVE debrief

A livelock vulnerability exists in the Linux kernel's quota subsystem that can cause system hangs when filesystem freeze operations and quota control operations execute concurrently on non-preemptible kernels. The issue occurs in quotactl_block() when it enters a retry loop waiting for a frozen filesystem to thaw. On kernels with preemption disabled, this loop lacks scheduling points, preventing the CPU from reaching an RCU quiescent state. This blocks synchronize_rcu() in the freezer's percpu_down_write() call, creating a circular wait: the quota process spins indefinitely waiting for the freezer to advance, while the freezer waits indefinitely for the quota process's CPU to report quiescence. The vulnerability results in 100% CPU usage by the quota process and complete hang of the freezer process. The fix adds cond_resched() to the retry loop, providing an RCU quiescent state that allows synchronize_rcu() to complete. This vulnerability affects systems running quota operations on frozen filesystems, particularly single-CPU or CPU-pinned workloads where the freezer and quota operations share a CPU.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running filesystem quota management alongside backup or maintenance operations that freeze filesystems; kernel maintainers and distributors; organizations using CPU pinning or single-core configurations for I/O-intensive workloads

Technical summary

The vulnerability is a livelock in fs/quota/quota.c's quotactl_block() function. When a filesystem is frozen via freeze_super(), quotactl_block() spins in a retry loop acquiring s_umount, checking freeze state, dropping s_umount, and using sb_start_write()/sb_end_write() to wait. On non-preemptible kernels, this tight loop never yields, preventing RCU quiescence. The freezer's sb_wait_write() → percpu_down_write() → synchronize_rcu() chain stalls waiting for the quota CPU, while the quota CPU stalls waiting for the freezer. The fix inserts cond_resched() into the retry loop, explicitly yielding and providing an RCU quiescent state. Multiple stable kernel branches received backports of this fix.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable tree commits resolving the livelock condition
  • Prioritize patching systems running quota operations with filesystem freeze/thaw cycles
  • Monitor for hung freezer processes or sustained 100% CPU usage in quota-related kernel threads
  • Consider avoiding concurrent quota and freeze operations on single-CPU or CPU-pinned workloads until patched
  • Review kernel preemption configuration; non-preemptible kernels are more susceptible to this livelock

Evidence notes

Vulnerability description sourced from official CVE record published 2026-05-27. Root cause identified as missing scheduling point in quotactl_block() retry loop. Fix confirmed via kernel.org stable tree commits adding cond_resched(). Reproduction scenario documented using xfs_freeze and quotaon/quotaoff on pinned CPU.

Official resources

2026-05-27