CVE-2026-45895: Linux Kernel Race Condition Vulnerability

CVE-2026-45895 Overview

CVE-2026-45895 is a livelock vulnerability in the Linux kernel quota subsystem. The flaw exists in the interaction between quotactl_block() and freeze_super() on kernels built with preemption disabled. When a filesystem is frozen, quotactl_block() enters a retry loop that never yields the CPU, preventing RCU quiescent states from being reached. This blocks synchronize_rcu() inside percpu_down_write() in the freezer path, producing a mutual hang. The result is a frozen freezer process and 100% CPU consumption by the quota process. The issue has been resolved upstream by inserting a cond_resched() call into the retry loop.

Critical Impact
A local unprivileged-to-privileged interaction between filesystem freeze and quota operations can produce a system-level livelock, resulting in denial of service through CPU exhaustion and an unresponsive freezer thread.

Affected Products

Linux kernel builds with preemption disabled (CONFIG_PREEMPT_NONE)
Filesystems supporting quota operations through quotactl_block() (for example, ext4 mounted with quota,usrquota,grpquota)
Stable kernel branches referenced in the linked git.kernel.org commits

Discovery Timeline

2026-05-27 - CVE-2026-45895 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45895

Vulnerability Analysis

The vulnerability is a livelock condition [CWE-833 class] between two kernel paths that contend over filesystem freeze state. quotactl_block() polls the freeze state in a tight retry loop. When the filesystem is in the process of being frozen, the loop acquires s_umount, observes the freeze, drops s_umount, and calls the sb_start_write() / sb_end_write() pair to wait for thaw. On non-preemptible kernels, this loop contains no scheduling points.

Concurrently, freeze_super() invokes sb_wait_write(), which calls percpu_down_write() and triggers synchronize_rcu(). Because the CPU running quotactl_block() never yields, it cannot report an RCU quiescent state. The RCU synchronization in the freezer thread therefore waits indefinitely. The freezer cannot advance, so the quota loop cannot exit, producing the livelock.

Root Cause

The root cause is the absence of an explicit reschedule point inside the quotactl_block() retry loop. On preemptible kernels the scheduler can preempt the spinning task and allow RCU to progress. On non-preemptible kernels the loop monopolizes the CPU. The fix adds cond_resched() to the loop, which acts as an RCU quiescent state and unblocks synchronize_rcu() inside percpu_down_write().

Attack Vector

The condition is reproducible by a local user with permission to invoke filesystem freeze and quota toggle operations. The reporter demonstrated reliable reproduction by pinning two loops to the same CPU: one running xfs_freeze -f and xfs_freeze -u, the other running quotaon and quotaoff against an ext4 filesystem mounted with quota enabled. The vulnerability manifests as a denial of service rather than memory corruption or code execution. Technical details are documented in the upstream commits, including commit 02bb1500f147 and commit 37ccd48cf35f.

Detection Methods for CVE-2026-45895

Indicators of Compromise

A kernel thread sustaining 100% CPU usage with stack traces pointing into quotactl_block() and sb_start_write() / sb_end_write().
A hung xfs_freeze or equivalent freeze caller blocked inside percpu_down_write() waiting on synchronize_rcu().
Filesystems stuck in a transitional freeze state that does not complete or thaw.

Detection Strategies

Monitor kernel softlockup and RCU stall warnings (rcu_sched detected stalls) referencing the quota or freeze code paths.
Inspect /proc/<pid>/stack for processes consuming a full CPU core to identify quota-related call chains.
Correlate concurrent invocations of quotaon/quotaoff and xfs_freeze against the same mount point in audit logs.

Monitoring Recommendations

Alert on sustained per-CPU utilization at 100% bound to a single kernel task, especially after filesystem freeze operations.
Track invocations of quota-management syscalls and freeze ioctls through Linux audit (auditd) rules.
Capture kernel logs via centralized logging to detect repeated RCU stall warnings indicative of the livelock pattern.

How to Mitigate CVE-2026-45895

Immediate Actions Required

Apply the upstream kernel fix that adds cond_resched() to the quotactl_block() retry loop.
Update to a stable kernel build that includes one of the referenced commits, such as 02bb1500f147, 37ccd48cf35f, 414259caf81a, 53b2314b26b6, or 77449e453dfc.
Restrict local privileged tooling that can simultaneously invoke filesystem freeze and quota toggle operations on production hosts.

Patch Information

The fix has been merged into mainline and backported to multiple stable branches. Refer to the upstream changes for the precise diff and backport targets: commit 414259caf81a, commit 53b2314b26b6, and commit 77449e453dfc. Distribution-specific kernel updates should be applied through the vendor package manager once available.

Workarounds

Avoid concurrent execution of filesystem freeze operations and quota enable/disable cycles on the same mount until a patched kernel is deployed.
Where feasible, run kernels built with voluntary or full preemption (CONFIG_PREEMPT_VOLUNTARY or CONFIG_PREEMPT) to reduce reproducibility of the livelock.
Limit access to CAP_SYS_ADMIN capabilities required to invoke quotactl and freeze ioctls to trusted administrative accounts only.

bash

# Verify running kernel includes the fix by checking for the upstream commit
uname -r
zgrep -i 'quotactl\|freeze_super' /proc/config.gz 2>/dev/null || \
  grep -i 'PREEMPT' /boot/config-$(uname -r)

# Restrict quota tooling to administrators only
chmod 0750 /usr/sbin/quotaon /usr/sbin/quotaoff /usr/sbin/xfs_freeze