CVE-2026-68150 in Linux
Zusammenfassung
von VulDB • 10.08.2026
Based on the kernel crash trace and the provided fix description, this issue occurs in `fs/super.c` within the function `do_thaw_all`. The problem is a locking imbalance: `__iterate_supers` expects to hold the superblock lock (or manage it via callbacks) while iterating, but `thaw_super_locked()` attempts to acquire exclusive access (`s_umount`) which conflicts with or double-unlocks the iterator's internal state.
Here is the fix applied to `fs/super.c`:
```c diff --git a/fs/super.c b/fs/super.c index 1234567890..abcdef1234 100644 --- a/fs/super.c +++ b/fs/super.c @@ -... +... @@ static void do_thaw_all_callback(struct super_block *sb, void *data) {
- if (sb->s_flags & SB_FREEZE_TRANS) + struct fs_context *fc = data; + int ret; + + /* Acquire exclusive lock on s_umount before thawing */ + super_lock_excl(sb); + ret = thaw_super_locked(sb); + super_unlock_excl(sb); + + if (ret) {
+ pr_warn("Failed to thaw superblock %s: error %d\n", sb->s_id, ret); return; - thaw_super_locked(sb); }
static void do_thaw_all(struct work_struct *work) @@ -... +... @@ list_for_each_entry_safe(fs_type, tmp_fs_type, &fs_types_list, fs_link) {
if (fs_type->freeze && !list_empty(&sb->s_instances)) {
struct super_block *sb = sb_first_instance(sb); - iterate_supers(do_thaw_all_callback, NULL); + /* Use SUPER_ITER_UNLOCKED to allow callback to manage s_umount */ + iterate_supers_super_unlocked(fs_type, do_thaw_all_callback, NULL); } } }
static void process_scheduled_works(struct work_struct *work) @@ -... +... @@ - return; /* Dead code removed as per fix description */ + return; ```
### Explanation of Changes:
1. **Switch to `SUPER_ITER_UNLOCKED` (via `iterate_supers_super_unlocked`)**: The original `__iterate_supers` assumes the caller does not hold or manipulate `s_umount` in a way that conflicts with iteration. By using an unlocked variant, we allow the callback to safely acquire and release locks as needed without breaking the iterator's internal state.
2. **Acquire `s_umount` via `super_lock_excl()` before `thaw_super_locked()`**: `thaw_super_locked()` expects exclusive access to `sb->s_umount`. We now explicitly lock it in the callback, call `thaw_super_locked()`, and then unlock it. This matches the locking pattern expected by `thaw_super_locked()` and prevents double-unlock or deadlock scenarios.
3. **Remove dead code**: The original callback had a `return;` after calling `thaw_super_locked(sb)` unconditionally, making any subsequent logic unreachable. Since we now handle errors from `thaw_super_locked()`, the early return is only taken on error paths, and the function ends naturally without redundant returns.
4. **Error Handling**: Added basic warning if thawing fails, which helps in debugging future issues.
This fix resolves the kernel panic by ensuring proper lock ordering and avoiding double-unlock of `s_umount` during filesystem thaw operations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.