CVE-2026-43127: ntfs3: fix circular locking dependency in run_unpack_ex
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: fix circular locking dependency in rununpackex
Syzbot reported a circular locking dependency between wnd->rwlock (sbi->used.bitmap) and ni->file.runlock.
The deadlock scenario: 1. ntfsextendmft() takes ni->file.runlock then wnd->rwlock. 2. rununpackex() takes wnd->rwlock then tries to acquire ni->file.runlock inside ntfsrefreshzone().
This creates an AB-BA deadlock.
Fix this by using downreadtrylock() instead of downread() when acquiring runlock in rununpackex(). If the lock is contended, skip ntfsrefreshzone() - the MFT zone will be refreshed on the next MFT operation. This breaks the circular dependency since we never block waiting for runlock while holding wnd->rwlock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In ntfs3 run_unpack_ex(), use down_read_trylock() instead of down_read() when acquiring ni->file.run_lock; if the lock is contended, skip ntfs_refresh_zone() so the MFT zone is refreshed on the next MFT operation.
Event History
Frequently Asked Questions
What access does an attacker need?
Exploitation requires local access and low privileges. No user interaction is required.
What is the security impact?
The reported impact is high availability impact, consistent with a kernel deadlock that can prevent affected operations from making progress. No confidentiality or integrity impact is indicated.
How does the fix avoid the deadlock?
The fix uses a non-blocking read-lock attempt for run_lock while holding rw_lock. If run_lock is contended, the MFT zone refresh is skipped and deferred until a later MFT operation rather than waiting and creating the circular lock dependency.