CVE-2026-68132 (GCVE-0-2026-68132)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-17 04:59
VLAI
Title
super: fix emergency thaw deadlock on frozen block devices
Summary
In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices do_thaw_all_callback() calls bdev_thaw() while holding sb->s_umount exclusively. If the block device was frozen via bdev_freeze() dropping the last block layer freeze reference calls fs_bdev_thaw() which reacquires s_umount: do_thaw_all_callback(sb) super_lock_excl(sb) # holds sb->s_umount bdev_thaw(sb->s_bdev) mutex_lock(&bdev->bd_fsfreeze_mutex) # bd_fsfreeze_count drops 1 -> 0 bd_holder_ops->thaw == fs_bdev_thaw get_bdev_super(bdev) bdev_super_lock(bdev, true) super_lock(sb, true) down_write(&sb->s_umount) # same task: deadlock The emergency thaw worker deadlocks against itself holding both s_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount, freeze, or thaw of that filesystem and block device. [ 81.878470] sysrq: Show Blocked State [ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 81.884876] Workqueue: events do_thaw_all [ 81.886656] Call Trace: [ 81.887759] <TASK> [ 81.888763] __schedule+0x579/0x1420 [ 81.890372] schedule+0x3a/0x100 [ 81.891794] schedule_preempt_disabled+0x15/0x30 [ 81.893848] rwsem_down_write_slowpath+0x1ea/0x900 [ 81.895191] ? __pfx_do_thaw_all_callback+0x10/0x10 [ 81.896528] down_write+0xbd/0xc0 [ 81.897505] super_lock+0x91/0x180 [ 81.898457] ? __mutex_lock+0xa99/0x1140 [ 81.900748] ? __mutex_unlock_slowpath+0x1f/0x400 [ 81.902069] bdev_super_lock+0x5b/0x150 [ 81.903132] get_bdev_super+0x10/0x60 [ 81.904042] fs_bdev_thaw+0x23/0xf0 [ 81.904755] bdev_thaw+0x82/0x100 [ 81.905484] do_thaw_all_callback+0x2c/0x50 [ 81.906298] __iterate_supers+0x5d/0x130 [ 81.907067] do_thaw_all+0x20/0x40 [ 81.907739] process_one_work+0x206/0x5e0 [ 81.908545] worker_thread+0x1e2/0x3c0 [ 81.909339] ? __pfx_worker_thread+0x10/0x10 [ 81.910171] kthread+0xf4/0x130 [ 81.910799] ? __pfx_kthread+0x10/0x10 [ 81.911528] ret_from_fork+0x2e2/0x3b0 [ 81.912259] ? __pfx_kthread+0x10/0x10 [ 81.913010] ret_from_fork_asm+0x1a/0x30 [ 81.913806] </TASK> bdev_super_lock() even documents the violated requirement with lockdep_assert_not_held(&sb->s_umount). Acquiring bd_fsfreeze_mutex under s_umount also inverts the bd_fsfreeze_mutex vs. s_umount ordering established by bdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer freeze even when the recursive path isn't hit. Fix this by not holding s_umount around the bdev_thaw() loop at all. Pin the superblock with an active reference instead as filesystems_freeze_callback() does. The active reference keeps the superblock from being shut down and so ->s_bdev stays valid without holding s_umount. The block-layer-held freeze is dropped by fs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as a regular unfreeze would and thaw_super_locked() handles filesystem-level freezes as before. The emergency thaw path has deadlocked like this in one form or another for a long long time but the current exclusively-held shape dates back to commit [1] where thaw_bdev() already ended in thaw_super() with s_umount held by do_thaw_all_callback().
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 08fdc8a0138afaf324296a342f32ad26ec465e43 , < 63d78b546eefc38ad9898dc839bfc94811ede547 (git)
Affected: 08fdc8a0138afaf324296a342f32ad26ec465e43 , < 4c483644d1a7709efe7d1be7dbf88cf4008a7864 (git)
Affected: 08fdc8a0138afaf324296a342f32ad26ec465e43 , < 749d7aa0377aae32af8c0a4ad43371e7bf830ab5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63d78b546eefc38ad9898dc839bfc94811ede547",
              "status": "affected",
              "version": "08fdc8a0138afaf324296a342f32ad26ec465e43",
              "versionType": "git"
            },
            {
              "lessThan": "4c483644d1a7709efe7d1be7dbf88cf4008a7864",
              "status": "affected",
              "version": "08fdc8a0138afaf324296a342f32ad26ec465e43",
              "versionType": "git"
            },
            {
              "lessThan": "749d7aa0377aae32af8c0a4ad43371e7bf830ab5",
              "status": "affected",
              "version": "08fdc8a0138afaf324296a342f32ad26ec465e43",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsuper: fix emergency thaw deadlock on frozen block devices\n\ndo_thaw_all_callback() calls bdev_thaw() while holding sb-\u003es_umount\nexclusively. If the block device was frozen via bdev_freeze() dropping\nthe last block layer freeze reference calls fs_bdev_thaw() which\nreacquires s_umount:\n\n  do_thaw_all_callback(sb)\n    super_lock_excl(sb)                     # holds sb-\u003es_umount\n    bdev_thaw(sb-\u003es_bdev)\n      mutex_lock(\u0026bdev-\u003ebd_fsfreeze_mutex)\n      # bd_fsfreeze_count drops 1 -\u003e 0\n      bd_holder_ops-\u003ethaw == fs_bdev_thaw\n        get_bdev_super(bdev)\n          bdev_super_lock(bdev, true)\n            super_lock(sb, true)\n              down_write(\u0026sb-\u003es_umount)     # same task: deadlock\n\nThe emergency thaw worker deadlocks against itself holding both\ns_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount,\nfreeze, or thaw of that filesystem and block device.\n\n  [   81.878470] sysrq: Show Blocked State\n  [   81.880140] task:kworker/0:1     state:D stack:0     pid:11    tgid:11    ppid:2      task_flags:0x4208060 flags:0x00080000\n  [   81.884876] Workqueue: events do_thaw_all\n  [   81.886656] Call Trace:\n  [   81.887759]  \u003cTASK\u003e\n  [   81.888763]  __schedule+0x579/0x1420\n  [   81.890372]  schedule+0x3a/0x100\n  [   81.891794]  schedule_preempt_disabled+0x15/0x30\n  [   81.893848]  rwsem_down_write_slowpath+0x1ea/0x900\n  [   81.895191]  ? __pfx_do_thaw_all_callback+0x10/0x10\n  [   81.896528]  down_write+0xbd/0xc0\n  [   81.897505]  super_lock+0x91/0x180\n  [   81.898457]  ? __mutex_lock+0xa99/0x1140\n  [   81.900748]  ? __mutex_unlock_slowpath+0x1f/0x400\n  [   81.902069]  bdev_super_lock+0x5b/0x150\n  [   81.903132]  get_bdev_super+0x10/0x60\n  [   81.904042]  fs_bdev_thaw+0x23/0xf0\n  [   81.904755]  bdev_thaw+0x82/0x100\n  [   81.905484]  do_thaw_all_callback+0x2c/0x50\n  [   81.906298]  __iterate_supers+0x5d/0x130\n  [   81.907067]  do_thaw_all+0x20/0x40\n  [   81.907739]  process_one_work+0x206/0x5e0\n  [   81.908545]  worker_thread+0x1e2/0x3c0\n  [   81.909339]  ? __pfx_worker_thread+0x10/0x10\n  [   81.910171]  kthread+0xf4/0x130\n  [   81.910799]  ? __pfx_kthread+0x10/0x10\n  [   81.911528]  ret_from_fork+0x2e2/0x3b0\n  [   81.912259]  ? __pfx_kthread+0x10/0x10\n  [   81.913010]  ret_from_fork_asm+0x1a/0x30\n  [   81.913806]  \u003c/TASK\u003e\n\nbdev_super_lock() even documents the violated requirement with\nlockdep_assert_not_held(\u0026sb-\u003es_umount).\n\nAcquiring bd_fsfreeze_mutex under s_umount also inverts the\nbd_fsfreeze_mutex vs. s_umount ordering established by\nbdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer\nfreeze even when the recursive path isn\u0027t hit.\n\nFix this by not holding s_umount around the bdev_thaw() loop at all. Pin\nthe superblock with an active reference instead as\nfilesystems_freeze_callback() does. The active reference keeps the\nsuperblock from being shut down and so -\u003es_bdev stays valid without\nholding s_umount. The block-layer-held freeze is dropped by\nfs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as\na regular unfreeze would and thaw_super_locked() handles\nfilesystem-level freezes as before.\n\nThe emergency thaw path has deadlocked like this in one form or\nanother for a long long time but the current exclusively-held\nshape dates back to commit [1] where thaw_bdev() already ended in\nthaw_super() with s_umount held by do_thaw_all_callback()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:59:24.192Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/63d78b546eefc38ad9898dc839bfc94811ede547"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c483644d1a7709efe7d1be7dbf88cf4008a7864"
        },
        {
          "url": "https://git.kernel.org/stable/c/749d7aa0377aae32af8c0a4ad43371e7bf830ab5"
        }
      ],
      "title": "super: fix emergency thaw deadlock on frozen block devices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68132",
    "datePublished": "2026-08-10T11:58:55.196Z",
    "dateReserved": "2026-07-30T09:28:09.370Z",
    "dateUpdated": "2026-08-17T04:59:24.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68132",
      "date": "2026-08-20",
      "epss": "0.00173",
      "percentile": "0.07081"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68132\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:19:58.607\",\"lastModified\":\"2026-08-17T05:18:13.020\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsuper: fix emergency thaw deadlock on frozen block devices\\n\\ndo_thaw_all_callback() calls bdev_thaw() while holding sb-\u003es_umount\\nexclusively. If the block device was frozen via bdev_freeze() dropping\\nthe last block layer freeze reference calls fs_bdev_thaw() which\\nreacquires s_umount:\\n\\n  do_thaw_all_callback(sb)\\n    super_lock_excl(sb)                     # holds sb-\u003es_umount\\n    bdev_thaw(sb-\u003es_bdev)\\n      mutex_lock(\u0026bdev-\u003ebd_fsfreeze_mutex)\\n      # bd_fsfreeze_count drops 1 -\u003e 0\\n      bd_holder_ops-\u003ethaw == fs_bdev_thaw\\n        get_bdev_super(bdev)\\n          bdev_super_lock(bdev, true)\\n            super_lock(sb, true)\\n              down_write(\u0026sb-\u003es_umount)     # same task: deadlock\\n\\nThe emergency thaw worker deadlocks against itself holding both\\ns_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount,\\nfreeze, or thaw of that filesystem and block device.\\n\\n  [   81.878470] sysrq: Show Blocked State\\n  [   81.880140] task:kworker/0:1     state:D stack:0     pid:11    tgid:11    ppid:2      task_flags:0x4208060 flags:0x00080000\\n  [   81.884876] Workqueue: events do_thaw_all\\n  [   81.886656] Call Trace:\\n  [   81.887759]  \u003cTASK\u003e\\n  [   81.888763]  __schedule+0x579/0x1420\\n  [   81.890372]  schedule+0x3a/0x100\\n  [   81.891794]  schedule_preempt_disabled+0x15/0x30\\n  [   81.893848]  rwsem_down_write_slowpath+0x1ea/0x900\\n  [   81.895191]  ? __pfx_do_thaw_all_callback+0x10/0x10\\n  [   81.896528]  down_write+0xbd/0xc0\\n  [   81.897505]  super_lock+0x91/0x180\\n  [   81.898457]  ? __mutex_lock+0xa99/0x1140\\n  [   81.900748]  ? __mutex_unlock_slowpath+0x1f/0x400\\n  [   81.902069]  bdev_super_lock+0x5b/0x150\\n  [   81.903132]  get_bdev_super+0x10/0x60\\n  [   81.904042]  fs_bdev_thaw+0x23/0xf0\\n  [   81.904755]  bdev_thaw+0x82/0x100\\n  [   81.905484]  do_thaw_all_callback+0x2c/0x50\\n  [   81.906298]  __iterate_supers+0x5d/0x130\\n  [   81.907067]  do_thaw_all+0x20/0x40\\n  [   81.907739]  process_one_work+0x206/0x5e0\\n  [   81.908545]  worker_thread+0x1e2/0x3c0\\n  [   81.909339]  ? __pfx_worker_thread+0x10/0x10\\n  [   81.910171]  kthread+0xf4/0x130\\n  [   81.910799]  ? __pfx_kthread+0x10/0x10\\n  [   81.911528]  ret_from_fork+0x2e2/0x3b0\\n  [   81.912259]  ? __pfx_kthread+0x10/0x10\\n  [   81.913010]  ret_from_fork_asm+0x1a/0x30\\n  [   81.913806]  \u003c/TASK\u003e\\n\\nbdev_super_lock() even documents the violated requirement with\\nlockdep_assert_not_held(\u0026sb-\u003es_umount).\\n\\nAcquiring bd_fsfreeze_mutex under s_umount also inverts the\\nbd_fsfreeze_mutex vs. s_umount ordering established by\\nbdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer\\nfreeze even when the recursive path isn\u0027t hit.\\n\\nFix this by not holding s_umount around the bdev_thaw() loop at all. Pin\\nthe superblock with an active reference instead as\\nfilesystems_freeze_callback() does. The active reference keeps the\\nsuperblock from being shut down and so -\u003es_bdev stays valid without\\nholding s_umount. The block-layer-held freeze is dropped by\\nfs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as\\na regular unfreeze would and thaw_super_locked() handles\\nfilesystem-level freezes as before.\\n\\nThe emergency thaw path has deadlocked like this in one form or\\nanother for a long long time but the current exclusively-held\\nshape dates back to commit [1] where thaw_bdev() already ended in\\nthaw_super() with s_umount held by do_thaw_all_callback().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"08fdc8a0138afaf324296a342f32ad26ec465e43\",\"lessThan\":\"63d78b546eefc38ad9898dc839bfc94811ede547\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"08fdc8a0138afaf324296a342f32ad26ec465e43\",\"lessThan\":\"4c483644d1a7709efe7d1be7dbf88cf4008a7864\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"08fdc8a0138afaf324296a342f32ad26ec465e43\",\"lessThan\":\"749d7aa0377aae32af8c0a4ad43371e7bf830ab5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4c483644d1a7709efe7d1be7dbf88cf4008a7864\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/63d78b546eefc38ad9898dc839bfc94811ede547\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/749d7aa0377aae32af8c0a4ad43371e7bf830ab5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-11T15:34:13+00:00",
      "cve": "CVE-2026-68132",
      "id": "CVE-2026-68132",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: super: fix emergency thaw deadlock on frozen block devices",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68132.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-18T16:56:26Z",
      "cve": "CVE-2026-68132",
      "id": "CVE-2026-68132",
      "initial_release_date": "2026-08-18T16:56:26Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68132",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68132.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.