{"id":"CVE-2026-99132","kind":"vulnerability","aliases":["CVE-2026-99132"],"related":[],"title":"Linux XFS: buffer lock held across sync commit can deadlock the kernel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf\n\nxfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous\nxfs_trans_commit(), which flushes the CIL push workqueue internally.\nIf shutdown occurs during the CIL push, xfs_buf_item_unpin() needs to\nlock these buffers to fail them, causing a deadlock:\n\n  setlabel:          holds buf lock -> flush_workqueue(xfs-cil)\n  CIL push worker:   xfs_buf_item_unpin -> xfs_buf_lock(same buf)\n\nRemove the xfs_trans_bhold() calls so that commit releases the buffer\nlocks normally.  After the sync commit, re-acquire the buffers via\nmp->m_sb_bp / mp->m_rtsb_bp for the on-disk writeback.","summary":"In XFS, the superblock buffer locks are held across a synchronous transaction commit that flushes the CIL push workqueue, so a shutdown during the push can deadlock the kernel. The sources describe a hang rather than code execution or data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","xfs"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:14+00:00","updated_at":"2026-10-28T11:36:14+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T11:36:14Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux XFS: buffer lock held across sync commit can deadlock the kernel","impact":"low","summary":"In XFS, the superblock buffer locks are held across a synchronous transaction commit that flushes the CIL push workqueue, so a shutdown during the push can deadlock the kernel. The sources describe a hang rather than code execution or data exposure.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","xfs"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel deadlock during filesystem shutdown, causing a hang or denial of service.","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected and fixed kernel versions and whether shutdown can be triggered by an unprivileged user.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000541,"input_tokens":3537,"output_tokens":375,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99132':15A,18A 'acquir':173C 'across':6A,31B,80C,97C 'bhold':157C 'bp':180C,184C 'buf':88C,92C,118C,134C,145C,149C,152C 'buffer':3A,27B,78C,95C,125C,164C,175C 'call':158C 'caus':129C 'cil':39B,106C,115C,140C,141C 'code':59B 'commit':8A,35B,83C,102C,161C,170C 'cve':13A,16A 'data':62B 'deadlock':10A,49B,131C 'describ':54B 'disk':189C 'execut':60B 'exposur':63B 'fail':127C 'flush':37B,104C,136C 'follow':69C 'hang':56B 'held':5A,30B 'hold':77C,93C,133C 'infrastructur':19B 'intern':109C 'item':119C,146C 'kernel':12A,20B,51B,67C 'linux':1A,21B,66C 'lock':4A,28B,79C,96C,123C,135C,150C,165C 'm':178C,182C 'mp':177C,181C 'need':121C 'normal':166C 'occur':112C 'on-disk':187C 'push':40B,47B,107C,116C,142C 'rather':57B 're':172C 're-acquir':171C 'releas':162C 'remov':153C 'resolv':73C 'rtsb':183C 'sb':87C,91C,179C 'sb/rtsb':94C 'setlabel':132C 'shutdown':44B,111C 'sourc':53B 'superblock':26B 'sync':7A,81C,86C,90C,169C 'synchron':33B,99C 'tran':101C,156C 'transact':34B,82C 'unpin':120C,147C 'via':176C 'vulner':70C 'worker':143C 'workqueu':41B,108C,137C 'writeback':190C 'xfs':2A,22B,24B,74C,85C,89C,100C,117C,139C,144C,148C,155C 'xfs-cil':138C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99132","severity":null,"published_at":"2026-10-28T11:17:33+00:00","modified_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}