CVE-2026-46061 jbd2: fix deadlock in jbd2_journal_cancel_revoke()
A deadlock in the Linux kernel's jbd2 journaling layer can cause system hangs, requiring a patch to fix lock ordering issues.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46061?
CVE-2026-46061 is a medium-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
jbd2: fix deadlock in jbd2_journal_cancel_revoke()
Commit f76d4c28a46a ("fs/jbd2: use sleeping version of __find_get_block()") changed jbd2_journal_cancel_revoke() to use __find_get_block_nonatomic() which holds the folio lock instead of i_private_lock. This breaks the lock ordering (folio -> buffer) and causes an ABBA deadlock when the filesystem blocksize < pagesize:
T1 T2 ext4_mkdir() ext4_init_new_dir() ext4_append() ext4_getblk() lock_buffer() <- A sync_blockdev() blkdev_writepages() writeback_iter() writeback_get_folio() folio_lock() <- B ext4_journal_get_create_access() jbd2_journal_cancel_revoke() __find_get_block_nonatomic() folio_lock() <- B block_write_full_folio() lock_buffer() <- A
This can occasionally cause generic/013 to hang.
Fix by only calling __find_get_block_nonatomic() when the passed buffer_head doesn't belong to the bdev, which is the only case that we need to look up its bdev alias. Otherwise, the lookup is redundant since the found buffer_head is equal to the one we passed in.
Weakness: CWE-667
Which versions are affected by CVE-2026-46061?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46061?
Apply the vendor's patch.
Is CVE-2026-46061 being exploited?
There is no known exploitation of CVE-2026-46061 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-46061, DEBIAN-CVE-2026-46061, GHSA-f5wj-8q5w-fqwr, ROOT-OS-UBUNTU-2404-CVE-2026-46061, UBUNTU-CVE-2026-46061.