CVE-2026-97902 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, users of Linux-based systems, especially those using block devices and filesystem freezing mechanisms. Linux kernel developers, maintainers, and users should verify kernel versions, monitor operations, and apply patches to prevent this issue. Affected operator, platform, vulnerability-management, and security-team impact should be considered.

Why it matters

CVE-2026-97902 is a Linux kernel vulnerability that can cause block devices to become permanently frozen due to a mismatch between filesystem and block device freeze status. Linux kernel developers, maintainers, and users should verify kernel versions, monitor operations, and apply patches to prevent this issue.

• Verification of Linux kernel versions and patch application is necessary to prevent permanent freezing of block devices.
• Monitoring of block device and filesystem operations is required to detect unusual freeze and thaw activities.
• Defensive measures should be taken to ensure that block devices are properly thawed after freezing operations.

Technical summary

The Linux kernel's modified behavior in handling nested freezes and thaws can cause a block device to become permanently frozen. When a filesystem is frozen and then thawed, the block device may remain frozen due to an incorrect return value from thaw_super_locked(). This issue arises from a change in the Linux kernel's handling of nested freezes and thaws, where a successful thaw operation could incorrectly return -EINVAL when other freezers remain, leading to an elevated bd_fsfreeze_count. As a result, a block device might not be mountable again after a series of freeze and thaw operations. The issue is caused by the Linux kernel's modified behavior in handling nested freezes and thaws. When a filesystem is

Defensive priority

Medium

Recommended defensive actions

• Review and apply the kernel patches to ensure the fix is implemented.
• Verify the Linux kernel version and update if necessary.
• Monitor block device and filesystem operations for unusual freeze and thaw activities.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The issue is caused by the Linux kernel's modified behavior in handling nested freezes and thaws. When a filesystem is frozen and then thawed, the block device may remain frozen due to an incorrect return value from thaw_super_locked(). This can lead to a block device becoming permanently frozen.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.