Circular Locking Dependency in Linux Kernel's OCFS2 Extension

CVE-2026-80879

What is CVE-2026-80879?

A circular locking dependency has been identified in the OCFS2 extension of the Linux kernel, leading to potential deadlocks during file operations. This vulnerability occurs when ocfs2_mknod() and ocfs2_dio_end_io_write() attempt to acquire locks in an overlapping manner, specifically involving INODE_ALLOC_SYSTEM_INODE, EXTENT_ALLOC_SYSTEM_INODE, and ORPHAN_DIR_SYSTEM_INODE. The issue arises due to the order of lock acquisition resulting in an unsafe locking scenario. The vulnerability has been addressed by modifying the ocfs2_dio_end_io_write() function to release EXTENT_ALLOC before acquiring ORPHAN_DIR, effectively breaking the circular dependency and improving system stability.

References