CVE-2026-53050
Received Received - Intake
Race Condition in Linux Kernel Quota Handling

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_active() with quota deactivation dquot_scan_active() can race with quota deactivation in quota_release_workfn() like: CPU0 (quota_release_workfn) CPU1 (dquot_scan_active) ============================== ============================== spin_lock(&dq_list_lock); list_replace_init( &releasing_dquots, &rls_head); /* dquot X on rls_head, dq_count == 0, DQ_ACTIVE_B still set */ spin_unlock(&dq_list_lock); synchronize_srcu(&dquot_srcu); spin_lock(&dq_list_lock); list_for_each_entry(dquot, &inuse_list, dq_inuse) { /* finds dquot X */ dquot_active(X) -> true atomic_inc(&X->dq_count); } spin_unlock(&dq_list_lock); spin_lock(&dq_list_lock); dquot = list_first_entry(&rls_head); WARN_ON_ONCE(atomic_read(&dquot->dq_count)); The problem is not only a cosmetic one as under memory pressure the caller of dquot_scan_active() can end up working on freed dquot. Fix the problem by making sure the dquot is removed from releasing list when we acquire a reference to it.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-25
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-53050
EUVD
EUVD-2026-38918
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by fixing the race condition in dquot_scan_active() with quota deactivation. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Executive Summary

This vulnerability exists in the Linux kernel's quota management system. It involves a race condition between the function dquot_scan_active() and quota deactivation handled by quota_release_workfn().

Specifically, dquot_scan_active() can operate on quota data structures (dquots) that are in the process of being deactivated and potentially freed. This happens because the dquot may still appear active while its reference count is zero, leading to a situation where dquot_scan_active() works on freed memory.

The issue is fixed by ensuring that when a reference to a dquot is acquired, it is properly removed from the releasing list, preventing use-after-free scenarios.

Impact Analysis

This vulnerability can lead to use-after-free conditions in the Linux kernel's quota subsystem. Under memory pressure, the system might operate on freed quota data structures, which can cause system instability, crashes, or potentially allow attackers to execute arbitrary code or escalate privileges.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53050. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart