CVE-2026-98444

Received Received - Intake

XFS Filesystem Quota Lock Release Failure

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfs_qm_flush_one fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is going to drop the dqflock, so we need to do it ourselves.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98444

EUVD

EUVD-2026-103684

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	ca378189fdfa890a4f0622f85ee41b710bbac271
Linux	Linux	ca378189fdfa890a4f0622f85ee41b710bbac271
Linux	Linux	d331fc154564548b605cde8427442b54c87d7fd3
Linux	Linux	6.12.14
Linux	Linux	6.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a failure to release a lock called the dquot flush lock when the system cannot find a buffer to flush. Specifically, the function xfs_qm_flush_one does not drop the lock if it cannot obtain the associated buffer, leaving the lock held indefinitely.

Detection Guidance

This vulnerability is specific to the XFS filesystem in the Linux kernel and involves a missing dquot flush lock drop. Detection requires checking kernel logs for XFS-related errors or warnings about dquot flush operations. Use commands like dmesg | grep -i xfs or journalctl -k | grep -i xfs to inspect kernel logs for XFS-related issues.

Impact Analysis

This vulnerability could lead to system hangs or performance degradation because the dquot flush lock remains held, preventing other processes from accessing or modifying the affected quotas. This may cause delays in disk operations or unresponsiveness in the system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to the XFS filesystem's dquot flush lock handling, which could lead to data corruption or system instability but does not inherently violate data protection regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the xfs dquot flush lock issue. Monitor kernel logs for xfs-related errors indicating lock contention or failed buffer flushes.

Hi! I’m here to help you understand CVE-2026-98444. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70