From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 648E3492525 for ; Fri, 25 Sep 2026 10:29:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790332178; cv=none; b=EQ2pW/c9F2mz3QMf/ST4ImKnO1nQUNfg6Ha3v3xHT0NoBizFpfq5RxifcNcm0MjPjBWF8uUUMny8s/rFpHppVY8jzY2U31/FpHhQ1RPiR1s8dUJgaCPRuxuijNtAbucyPlZiYLznMWH8wBzt43Go3xwgGPgC67cYSCkRGjQNG8o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790332178; c=relaxed/simple; bh=8+Qs6e2eoRcnphreaPEuXh6ZzROSN+tGjrH08yNZZkQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=HsA3caeJiBdYZWGrtn0Cg6p8UFX/F/mU9wSpKD6Rj+5m48WPFRCot0ls0dGzYSNZRBBmrnVKOIKL3GvncPp8YDtkQRl/XUgwCRMKCfwdgpqwidfWFZJbpSzj7ttEe22XeHcNYUU4oGvIwWPKolZu4Fuuxx3MoWKz0QX87UfejaQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VbJmNeZp; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="VbJmNeZp" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF5D91F00893; Fri, 25 Sep 2026 10:29:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790332177; bh=KhhqXf3fxpoXLMwGjr+EienM7XKxao+kZmJPuLq58Zg=; h=From:To:Cc:Subject:Date:Reply-To; b=VbJmNeZp9v/OhsF7Qvr/1Vut8QpWUuHXxRf848UsHXoDHdGRddP7wZNyKwuR/zhcf F+2U6xdQnzuiWWlG2MWWVqAfdXJqenmEemR0YQNj/k6RE5PPLndb6/6bHeSaVBAdG2 JNQ9SPQdY5U2HjaZ5SBLi262DFStuRgebv/hxqRI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw Date: Fri, 25 Sep 2026 12:23:25 +0200 Message-ID: <2026092504-CVE-2026-97902-b5ca@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4536; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=y1iycK6xfmPaw+qiSe5xgPm1MIbty/v3BpeCxlDvG70=; b=owGbwMvMwCRo6H6F97bub03G02pJDFnbvH3O80m2znZaetj3uvDSVf7pp3sfTrSe+VdhxfuVE nE3nihd7YhlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJrJZnmB8UnrDDQuGUZMLW qSnhkz7buW4qmMKw4Jx24Fz29o5PXvl3rvsHr7fPnXhDEwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6a ("fs: handle freezing from multiple devices") replaced the freeze_holders bitmask with per-holder counters to allow nested freezes. In the bitmask version, a thaw that released a shared hold while another holder remained returned 0. Since the rework, thaw_super_locked() drops the freeze reference via freeze_dec() but then returns -EINVAL when other freezers remain, misinforming the caller: the thaw did succeed, the superblock just stays frozen for the remaining holders. This breaks bdev-initiated freezing. When a filesystem is frozen with FIFREEZE and additionally frozen via bdev_freeze() -- which nests by design, see fs_bdev_freeze() -- the subsequent bdev_thaw() receives -EINVAL from the holder op although its freeze reference was dropped, and therefore keeps bd_fsfreeze_count elevated. Then device-mapper's unlock_fs() ignores bdev_thaw()'s return value, so nothing rebalances the count. After the user's FITHAW and umount, the block device can never be mounted again: dm-1: Can't mount, blockdev is frozen There is no way for userspace to drop the leaked count; only destroying the block device (or a reboot) recovers the device. Reproducer (any kernel since v6.8): dmsetup create dut --table "0 $(blockdev --getsz "$DEV") linear $DEV 0" mkfs.ext4 /dev/mapper/dut mount /dev/mapper/dut /mnt fsfreeze --freeze /mnt # freeze_ucount == 1 dmsetup suspend dut # bd_fsfreeze_count == 1, ucount == 2 dmsetup resume dut # ucount 2 -> 1, but thaw_super() # returns -EINVAL, so bdev_thaw() # keeps bd_fsfreeze_count at 1 fsfreeze --unfreeze /mnt # filesystem thaws fine umount /mnt mount /dev/mapper/dut /mnt # EBUSY, forever The same happens with fsfreeze held across an LVM snapshot of the origin volume. fs_bdev_thaw()'s documentation already describes the intended semantics: "If this function returns zero it doesn't mean that the filesystem is unfrozen as it may have been frozen multiple times". Restore them by returning 0 when a nested thaw drops its hold while other freezers remain. Thawing without holding a freeze still fails with -EINVAL as may_unfreeze() rejects that case before the reference count is touched. The Linux kernel CVE team has assigned CVE-2026-97902 to this issue. Affected and fixed versions =========================== Issue introduced in 6.8 with commit 7366f8b6fc6aa21c4199cb5d337b023df69745b0 and fixed in 6.12.111 with commit 111339816138f042a59778322f941edc26903484 Issue introduced in 6.8 with commit 7366f8b6fc6aa21c4199cb5d337b023df69745b0 and fixed in 6.18.53 with commit 76e478499913dc1f368aebe85b28b7d1265985ff Issue introduced in 6.8 with commit 7366f8b6fc6aa21c4199cb5d337b023df69745b0 and fixed in 7.2.7 with commit ff2a694f6613d54ebd77ba72583d4d94446f55bd Issue introduced in 6.8 with commit 7366f8b6fc6aa21c4199cb5d337b023df69745b0 and fixed in 7.3-rc3 with commit fe967191e5851ea79818c5fe4e781c3882139218 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-97902 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/super.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/111339816138f042a59778322f941edc26903484 https://git.kernel.org/stable/c/76e478499913dc1f368aebe85b28b7d1265985ff https://git.kernel.org/stable/c/ff2a694f6613d54ebd77ba72583d4d94446f55bd https://git.kernel.org/stable/c/fe967191e5851ea79818c5fe4e781c3882139218