CVE-2026-80804: xfs: restore nofs context unconditionally in xfs_trans_roll
In the Linux kernel, the following vulnerability has been resolved:
xfs: restore nofs context unconditionally in xfstransroll
When xfstranscommit() fails in xfstransroll(), the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a circular lock dependency between xfsnondirilockclass and fsreclaim:
CPU0 CPU1 ---- ---- lock(&xfsnondirilockclass); lock(fsreclaim); lock(&xfsnondirilockclass); lock(fsreclaim);
Fix this by moving xfstranssetcontext() before the error check so that nofs context is always restored on the new transaction.
Affected Software
Event History
Frequently Asked Questions
When can the missing NOFS protection occur?
It occurs when __xfs_trans_commit() fails while xfs_trans_roll() is executing. In that error path, the prior behavior cleared the NOFS context without restoring it for the new transaction.
What is the operational consequence of reaching the affected error path?
The missing NOFS protection can create a circular lock dependency involving xfs_nondir_ilock_class and fs_reclaim. The fix restores the transaction context before checking for the commit error, so the context is restored on both success and error paths.