Skip to content
Fencer Vulns
no cvss —

CVE-2026-68132 json

super: fix emergency thaw deadlock on frozen block devices

published 2026-08-10 2 mo ago modified 2026-11-06 3 d ago also EUVD-2026-55513

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

super: fix emergency thaw deadlock on frozen block devices

do_thaw_all_callback() calls bdev_thaw() while holding sb->s_umount exclusively. If the block device was frozen via bdev_freeze() dropping the last block layer freeze reference calls fs_bdev_thaw() which reacquires s_umount:

do_thaw_all_callback(sb) super_lock_excl(sb) # holds sb->s_umount bdev_thaw(sb->s_bdev) mutex_lock(&bdev->bd_fsfreeze_mutex) # bd_fsfreeze_count drops 1 -> 0 bd_holder_ops->thaw == fs_bdev_thaw get_bdev_super(bdev) bdev_super_lock(bdev, true) super_lock(sb, true) down_write(&sb->s_umount) # same task: deadlock

The emergency thaw worker deadlocks against itself holding both s_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount, freeze, or thaw of that filesystem and block device.

[ 81.878470] sysrq: Show Blocked State [ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 81.884876] Workqueue: events do_thaw_all [ 81.886656] Call Trace: [ 81.887759] <TASK> [ 81.888763] __schedule+0x579/0x1420 [ 81.890372] schedule+0x3a/0x100 [ 81.891794] schedule_preempt_disabled+0x15/0x30 [ 81.893848] rwsem_down_write_slowpath+0x1ea/0x900 [ 81.895191] ? __pfx_do_thaw_all_callback+0x10/0x10 [ 81.896528] down_write+0xbd/0xc0 [ 81.897505] super_lock+0x91/0x180 [ 81.898457] ? __mutex_lock+0xa99/0x1140 [ 81.900748] ? __mutex_unlock_slowpath+0x1f/0x400 [ 81.902069] bdev_super_lock+0x5b/0x150 [ 81.903132] get_bdev_super+0x10/0x60 [ 81.904042] fs_bdev_thaw+0x23/0xf0 [ 81.904755] bdev_thaw+0x82/0x100 [ 81.905484] do_thaw_all_callback+0x2c/0x50 [ 81.906298] __iterate_supers+0x5d/0x130 [ 81.907067] do_thaw_all+0x20/0x40 [ 81.907739] process_one_work+0x206/0x5e0 [ 81.908545] worker_thread+0x1e2/0x3c0 [ 81.909339] ? __pfx_worker_thread+0x10/0x10 [ 81.910171] kthread+0xf4/0x130 [ 81.910799] ? __pfx_kthread+0x10/0x10 [ 81.911528] ret_from_fork+0x2e2/0x3b0 [ 81.912259] ? __pfx_kthread+0x10/0x10 [ 81.913010] ret_from_fork_asm+0x1a/0x30 [ 81.913806] </TASK>

bdev_super_lock() even documents the violated requirement with lockdep_assert_not_held(&sb->s_umount).

Acquiring bd_fsfreeze_mutex under s_umount also inverts the bd_fsfreeze_mutex vs. s_umount ordering established by bdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer freeze even when the recursive path isn't hit.

Fix this by not holding s_umount around the bdev_thaw() loop at all. Pin the superblock with an active reference instead as filesystems_freeze_callback() does. The active reference keeps the superblock from being shut down and so ->s_bdev stays valid without holding s_umount. The block-layer-held freeze is dropped by fs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as a regular unfreeze would and thaw_super_locked() handles filesystem-level freezes as before.

The emergency thaw path has deadlocked like this in one form or another for a long long time but the current exclusively-held shape dates back to commit [1] where thaw_bdev() already ended in thaw_super() with s_umount held by do_thaw_all_callback().

Patch / fix

  • Linux Linux 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.42, 7.1.6, 7.2
  • linux Debian 12 6.1.187-1
  • linux Debian 13 6.12.105-1
  • linux Debian 14 7.1.6-1
  • linux-6.12 Debian 12 6.12.107-1~deb12u1

debian advisories DEBIAN-CVE-2026-68132

  • linux Ubuntu 22.04 LTS 5.15.0-202.212
  • linux Ubuntu 26.04 LTS 7.0.0-38.38
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1119.126
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1014.14
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1120.130
  • linux-gcp Ubuntu 26.04 LTS 7.0.0-1014.14
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1115.121
  • linux-gke Ubuntu 26.04 LTS 7.0.0-1008.9

ubuntu advisories UBUNTU-CVE-2026-68132

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1
  • kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.81.1
  • kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.81.1
  • kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1
  • kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.81.1
  • kernel-zfcpdump SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1
  • kernel-obs-build SLE Module for Development Tools 15 SP7 6.4.0-150700.53.81.1
  • kernel-default-base SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1.150700.17.45.1

suse advisories SUSE-SU-2026:4254-1SUSE-SU-2026:23887-1SUSE-SU-2026:23902-1SUSE-SU-2026:23897-1SUSE-SU-2026:23881-1SUSE-SU-2026:4120-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.38.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.38.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.38.1

opensuse advisories openSUSE-SU-2026:21910-1

  • kernel Azure Linux 3.0 6.6.157.1-1

azure linux advisories AZL-95139

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-68132 updated cvss 5.5

kernel: super: fix emergency thaw deadlock on frozen block devices

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 d ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.