CVE-2026-93252 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix circular locking dependency in ocfs2_init_acl()
A lockdep warning indicates a circular locking dependency between `&oi->ip_xattr_sem` and `&journal->j_trans_barrier`:
WARNING: possible circular locking dependency detected is trying to acquire lock: (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0
fs/ocfs2/acl.c:367
but task is already holding lock: (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700
fs/ocfs2/journal.c:369
The deadlock involves two code paths: Path 1 (setxattr) where `ocfs2_xattr_set()` acquires `ip_xattr_sem` (write) and then starts a transaction, which acquires `j_trans_barrier` (read); and Path 2 (mkdir/mknod) where `ocfs2_mknod()` starts a transaction (`j_trans_barrier` read) and then calls `ocfs2_init_acl()`, which attempts to acquire `ip_xattr_sem` (read) on the parent directory to retrieve the default ACL.
Because rw_semaphores are subject to writer priority, a pending writer on `j_trans_barrier` (e.g., the journal commit thread) can cause Path 1 to block, while Path 2 is blocked waiting for Path 1 to release `ip_xattr_sem`.
The patch fixes the lock ordering by precomputing the ACL state before starting the OCFS2 transaction, while preserving POSIX ACL storage semantics and the existing inode/security initialization order. By reading the parent directory's default ACL and preparing the new inode's ACLs outside the transaction, `ip_xattr_sem` is always acquired before `j_trans_barrier`.
`struct ocfs2_acl_state` encapsulates the prepared ACL state, while `ocfs2_acl_init_prepare()` and `ocfs2_acl_init_release()` avoid code duplication between `ocfs2_mknod()` and `ocfs2_init_security_and_acl()`. `ocfs2_calc_xattr_init()` and `ocfs2_init_acl()` use this precomputed state, removing internal `ip_xattr_sem` acquisition and redundant disk reads.
Additionally, remove the `ip_xattr_sem` acquisition from `ocfs2_xattr_set_handle()`. This function is only used while initializing a new inode that has not yet been inserted into the inode hash or attached to a dentry, meaning there is no risk of concurrent access and the lock is unnecessary.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel's OCFS2 filesystem driver contained a critical circular locking dependency within its Access Control List initialization logic, specifically involving the interaction between inode attribute semaphore locks and journal transaction barriers. This vulnerability manifested as a deadlock scenario detected by the kernel’s lockdep subsystem, where two distinct code paths acquired resources in an inconsistent order that violated established locking hierarchies. The first path was triggered during extended attribute set operations via ocfs2_xattr_set, which sequentially acquired the inode xattr semaphore for writing and subsequently initiated a journal transaction requiring the read barrier of the journal structure. Conversely, the second path occurred during directory creation or node instantiation through ocfs2_mknod, where the process began by starting a journal transaction to acquire the journal’s trans_barrier lock before attempting to retrieve default Access Control Lists from the parent directory via ocfs2_init_acl, which required acquiring the same inode xattr semaphore but in read mode. This inversion of lock acquisition order created a classic deadlock condition exacerbated by reader-writer semaphore priority mechanisms, where pending writers on the journal barrier could block the first path while the second path remained blocked waiting for the first to release its exclusive hold on the inode semaphore.
From a technical perspective, this flaw represents a violation of consistent lock ordering principles essential for preventing deadlocks in concurrent systems. The operational impact involves potential system hangs or kernel panics when these specific filesystem operations are executed under high concurrency or heavy I/O loads that increase contention on journal barriers and inode locks. Such instability compromises the availability guarantee provided by the operating system, potentially leading to denial of service conditions for users relying on OCFS2 storage services. The vulnerability aligns with CWE-833, which describes Lock Inversion issues where multiple threads acquire locks in a different order than expected or required, creating cycles in the lock dependency graph that can never be resolved without external intervention such as kernel restarts.
The remediation strategy implemented by the patch addresses this structural flaw by reordering operations to ensure strict adherence to a safe locking hierarchy. The core of the fix involves precomputing the ACL state before entering any journal transaction context, thereby ensuring that all necessary semaphore acquisitions occur prior to acquiring the journal barrier lock. This is achieved through new helper functions ocfs2_acl_init_prepare and ocfs2_acl_init_release which encapsulate the logic for reading parent directory default ACLs and preparing inode security structures outside of the protected critical sections associated with transactions. By decoupling the ACL preparation phase from the transactional commit phase, the code eliminates the possibility of holding a journal lock while attempting to acquire an inode semaphore that might be contended by other processes also trying to modify attributes or create new nodes.
Furthermore, the patch optimizes performance and reduces complexity by removing unnecessary locking in ocfs2_xattr_set_handle. Since this function operates exclusively during the initialization of new inodes that are not yet visible to concurrent access through standard filesystem paths, it does not require protection against race conditions via the inode xattr semaphore. Removing this superfluous lock acquisition further simplifies the codebase and reduces overhead without compromising security integrity. This change also eliminates redundant disk reads by leveraging precomputed state rather than re-fetching information within locked contexts. The solution maintains POSIX ACL storage semantics while ensuring that the order of operations strictly follows ip_xattr_sem before j_trans_barrier, thereby eliminating the circular dependency entirely.
In terms of industry standards and threat modeling, this vulnerability can be mapped to MITRE ATT&CK technique T1496, Resource Hijacking, specifically regarding denial-of-service through resource exhaustion or system instability caused by kernel-level deadlocks. Although not directly exploitable for privilege escalation in most scenarios due to the nature of locking issues requiring specific timing and concurrent access patterns, it poses a significant risk to system stability and availability. Security practitioners should ensure that systems running OCFS2 are updated with this patch applied to prevent potential service disruptions during high-concurrency file operations. Regular auditing of kernel logs for lockdep warnings is recommended as an early detection mechanism for similar locking inconsistencies in other subsystems before they manifest as critical production outages.