CVE-2026-45895: quota: fix livelock between quotactl and freeze_super
In the Linux kernel, the following vulnerability has been resolved:
quota: fix livelock between quotactl and freezesuper
When a filesystem is frozen, quotactlblock() enters a retry loop waiting for the filesystem to thaw. It acquires sumount, checks the freeze state, drops sumount and uses sbstartwrite() - sbendwrite() pair to wait for the unfreeze.
However, this retry loop can trigger a livelock issue, specifically on kernels with preemption disabled.
The mechanism is as follows: 1. freezesuper() sets SBFREEZEWRITE and calls sbwaitwrite(). 2. sbwaitwrite() calls percpudownwrite(), which initiates synchronizercu(). 3. Simultaneously, quotactlblock() spins in its retry loop, immediately executing the sbstartwrite() - sbendwrite() pair. 4. Because the kernel is non-preemptible and the loop contains no scheduling points, quotactlblock() never yields the CPU. This prevents that CPU from reaching an RCU quiescent state. 5. synchronizercu() in the freezer thread waits indefinitely for the quotactlblock() CPU to report a quiescent state. 6. quotactlblock() spins indefinitely waiting for the freezer to advance, which it cannot do as it is blocked on the RCU sync.
This results in a hang of the freezer process and 100% CPU usage by the quota process.
While this can occur intermittently on multi-core systems, it is reliably reproducing on a node with the following script, running both the freezer and the quota toggle on the same CPU:
# mkfs.ext4 -O quota /dev/sda 2g && mkdir amount # mount /dev/sda -o quota,usrquota,grpquota amount # taskset -c 3 bash -c "while true; do xfsfreeze -f amount; \ xfsfreeze -u amount; done" & # taskset -c 3 bash -c "while true; do quotaon amount; \ quotaoff amount; done" &
Adding condresched() to the retry loop fixes the issue. It acts as an RCU quiescent state, allowing synchronizercu() in percpudownwrite() to complete.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1062.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-136.136~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1058.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1055.56~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-134.134 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1063.71 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1058.64 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1045.48 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1060.61 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1058.61 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1058.61.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1029.30 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1060.64 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1032.33 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1026.30 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2049.50 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1055.56 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-134.134+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69+fips1 - Compensating control
Add cond_resched() to the quotactl_block() retry loop to prevent the livelock between quotactl and freeze_super.
Event History
Frequently Asked Questions
What conditions are needed to trigger the livelock?
A filesystem must be frozen while quotactl_block() is retrying a quota-control operation and freeze_super() is waiting for active writers. The described deadlock mechanism specifically requires a non-preemptible kernel context where the retry loop has no scheduling point.
What is the operational impact?
The filesystem-freeze path can wait indefinitely in synchronize_rcu(), while quotactl_block() simultaneously spins waiting for the freeze operation to progress. This results in a livelock and can cause a denial of service.
What access does an attacker need?
The supplied vector identifies local access with low privileges and no user interaction. The description does not identify a remote attack path.