CVE-2026-31598: ocfs2: fix possible deadlock between unlink and dio_end_io_write
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix possible deadlock between unlink and dioendiowrite
ocfs2unlink takes orphan dir inodelock first and then ipallocsem, while in ocfs2dioendiowrite, it acquires these locks in reverse order. This creates an ABBA lock ordering violation on lock classes ocfs2sysfilelockkey[ORPHANDIRSYSTEMINODE] and ocfs2fileipallocsemkey.
Lock Chain #0 (orphan dir inodelock -> ipallocsem): ocfs2unlink ocfs2prepareorphandir ocfs2lookuplockorphandir inodelock(orphandirinode) <- lock A ocfs2prepareorphandir ocfs2preparedirforinsert ocfs2extenddir ocfs2expandinlinedir downwrite(&oi->ipallocsem) <- Lock B
Lock Chain #1 (ipallocsem -> orphan dir inodelock): ocfs2dioendiowrite downwrite(&oi->ipallocsem) <- Lock B ocfs2delinodefromorphan() inodelock(orphandirinode) <- Lock A
Deadlock Scenario: CPU0 (unlink) CPU1 (dioendiowrite) ------ ------ inodelock(orphandirinode) downwrite(ipallocsem) downwrite(ipallocsem) inodelock(orphandirinode)
Since ipallocsem is to protect allocation changes, which is unrelated with operations in ocfs2delinodefromorphan. So move ocfs2delinodefromorphan out of ipallocsem to fix the deadlock.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31598?
CVE-2026-31598 has a severity rating of high at 7.5 based on the CVSS 3.1 scoring.
How do I fix CVE-2026-31598?
To fix CVE-2026-31598, apply the available patches provided by the Linux kernel.
What does CVE-2026-31598 affect?
CVE-2026-31598 affects the ocfs2 component of the Linux kernel.
What is the risk associated with CVE-2026-31598?
The risk associated with CVE-2026-31598 is rated at 43, indicating a significant vulnerability.
What are the lock acquisition issues in CVE-2026-31598?
CVE-2026-31598 involves a potential deadlock situation due to the inversion of lock acquisition order in ocfs2 operations.