CVE-2026-53050 quota: Fix race of dquot_scan_active() with quota deactivation
A race condition in the Linux kernel quota subsystem allows attackers to access freed memory, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53050?
CVE-2026-53050 is a high-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
quota: Fix race of dquot_scan_active() with quota deactivation
dquot_scan_active() can race with quota deactivation in quota_release_workfn() like:
CPU0 (quota_release_workfn) CPU1 (dquot_scan_active) ============================== ============================== spin_lock(&dq_list_lock); list_replace_init( &releasing_dquots, &rls_head); /* dquot X on rls_head, dq_count == 0, DQ_ACTIVE_B still set */ spin_unlock(&dq_list_lock); synchronize_srcu(&dquot_srcu); spin_lock(&dq_list_lock); list_for_each_entry(dquot, &inuse_list, dq_inuse) { /* finds dquot X */ dquot_active(X) -> true atomic_inc(&X->dq_count); } spin_unlock(&dq_list_lock); spin_lock(&dq_list_lock); dquot = list_first_entry(&rls_head); WARN_ON_ONCE(atomic_read(&dquot->dq_count));
The problem is not only a cosmetic one as under memory pressure the caller of dquot_scan_active() can end up working on freed dquot.
Fix the problem by making sure the dquot is removed from releasing list when we acquire a reference to it.
Weakness: CWE-362
Which versions are affected by CVE-2026-53050?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53050?
Apply the vendor's patch.
Is CVE-2026-53050 being exploited?
There is no known exploitation of CVE-2026-53050 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53050, DEBIAN-CVE-2026-53050, GHSA-4mf5-rjc5-62qc, ROOT-OS-DEBIAN-11-CVE-2026-53050, ROOT-OS-DEBIAN-12-CVE-2026-53050, ROOT-OS-UBUNTU-2204-CVE-2026-53050 and 2 more.