CVE-2026-53050

Analyzed Analyzed - Analysis Complete

Race Condition in Linux Kernel Quota Handling

Publication date: 2026-06-24

Last updated on: 2026-07-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_active() with quota deactivation dquot_scan_active() can race with quota deactivation in quota_release_workfn() like: CPU0 (quota_release_workfn) CPU1 (dquot_scan_active) ============================== ============================== spin_lock(&dq_list_lock); list_replace_init( &releasing_dquots, &rls_head); /* dquot X on rls_head, dq_count == 0, DQ_ACTIVE_B still set */ spin_unlock(&dq_list_lock); synchronize_srcu(&dquot_srcu); spin_lock(&dq_list_lock); list_for_each_entry(dquot, &inuse_list, dq_inuse) { /* finds dquot X */ dquot_active(X) -> true atomic_inc(&X->dq_count); } spin_unlock(&dq_list_lock); spin_lock(&dq_list_lock); dquot = list_first_entry(&rls_head); WARN_ON_ONCE(atomic_read(&dquot->dq_count)); The problem is not only a cosmetic one as under memory pressure the caller of dquot_scan_active() can end up working on freed dquot. Fix the problem by making sure the dquot is removed from releasing list when we acquire a reference to it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-06-24

EPSS Evaluated

2026-08-03

NVD

CVE-2026-53050

EUVD

EUVD-2026-38918

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.6
linux	linux_kernel	6.6
linux	linux_kernel	6.6
linux	linux_kernel	From 6.5.8 (inc) to 6.6 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 4.19.297 (inc) to 4.20 (exc)
linux	linux_kernel	From 5.10.199 (inc) to 5.10.258 (exc)
linux	linux_kernel	From 5.15.136 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 5.4.259 (inc) to 5.5 (exc)
linux	linux_kernel	From 6.1.59 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.6.1 (inc) to 6.6.141 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's quota management system. It involves a race condition between the function dquot_scan_active() and quota deactivation handled by quota_release_workfn().

Specifically, dquot_scan_active() can operate on quota data structures (dquots) that are in the process of being deactivated and potentially freed. This happens because the dquot may still appear active while its reference count is zero, leading to a situation where dquot_scan_active() works on freed memory.

The issue is fixed by ensuring that when a reference to a dquot is acquired, it is properly removed from the releasing list, preventing use-after-free scenarios.

Impact Analysis

This vulnerability can lead to use-after-free conditions in the Linux kernel's quota subsystem. Under memory pressure, the system might operate on freed quota data structures, which can cause system instability, crashes, or potentially allow attackers to execute arbitrary code or escalate privileges.

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by fixing the race condition in dquot_scan_active() with quota deactivation. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Hi! I’m here to help you understand CVE-2026-53050. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70