5.5

CVE-2026-46061: jbd2: fix deadlock in jbd2_journal_cancel_revoke()

Analyzed
AliasesUBUNTU-CVE-2026-46061DEBIAN-CVE-2026-46061
Published 27-05-2026Last modified 14-06-2026

Vulnerability summary

CVE-2026-46061 is a medium (CVSS 5.5) Improper Locking vulnerability in linux. EPSS estimates a 0.09% chance of exploitation in the next 30 days, higher than 0.5% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.09%
0%100%
Low · -0.03 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 21 · Related 21
OPENSUSE-SU-2026:10954-1USN-8488-1USN-8488-2USN-8489-1USN-8507-1USN-8567-1

Timeline

  1. 27-05-2026
    PublishedVulnerability first disclosed.
  2. 14-06-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix deadlock in jbd2_journal_cancel_revoke() Commit f76d4c28a46a ("fs/jbd2: use sleeping version of __find_get_block()") changed jbd2_journal_cancel_revoke() to use __find_get_block_nonatomic() which holds the folio lock instead of i_private_lock. This breaks the lock ordering (folio -> buffer) and causes an ABBA deadlock when the filesystem blocksize < pagesize: T1 T2 ext4_mkdir() ext4_init_new_dir() ext4_append() ext4_getblk() lock_buffer() <- A sync_blockdev() blkdev_writepages() writeback_iter() writeback_get_folio() folio_lock() <- B ext4_journal_get_create_access() jbd2_journal_cancel_revoke() __find_get_block_nonatomic() folio_lock() <- B block_write_full_folio() lock_buffer() <- A This can occasionally cause generic/013 to hang. Fix by only calling __find_get_block_nonatomic() when the passed buffer_head doesn't belong to the bdev, which is the only case that we need to look up its bdev alias. Otherwise, the lookup is redundant since the found buffer_head is equal to the one we passed in.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.09%

Chance of exploitation in the next 30 days

Percentile

1%

Versus all other CVEs

30-day change

Decrease -0.03 pp

From 0.13% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu132 products
  • linux< 6.8.0-136.136 | All versions (No fix recorded) | < 7.0.0-27.27
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 6.8.0-1061.64 | All versions (No fix recorded) | < 7.0.0-1008.8
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ f1c5aa614b5c251f93a6a4c8c26001d5e9e53fd6, < dff07cc98fdf6af57a7c054dc09b2050a9d5c287 | ≥ f76d4c28a46a9260d85e00dafc8f46d369365d33, < 2b2fee890250ab647a601124471a334bb01a0790 | ≥ f76d4c28a46a9260d85e00dafc8f46d369365d33, < bbd943d6a2d566428324b516a37f98328dfb802d | ≥ f76d4c28a46a9260d85e00dafc8f46d369365d33, < 981fcc5674e67158d24d23e841523eccba19d0e7 | 1bb7a4b6b3d7dd8da6f5a9d0529d42c22a359e71 | ≥ 6.12.31, < 6.12.86 | ≥ 6.14.9, < 6.15 | 6.15
  • linux_kernelEOL≥ 6.12.31, < 6.12.86 | ≥ 6.14.9, < 6.15 | ≥ 6.15.1, < 6.18.27 | ≥ 6.19, < 7.0.4 | 6.15 | 6.15:rc4 | 6.15:rc5 | 6.15:rc6 | 6.15:rc7
Debian1 product
  • linux< 6.12.86-1 | < 7.0.4-1

3 vendors · 135 products

References

28 links
Show all 28 references