{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97902 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97902 is a denial of service vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-97902 and fix it if it is affected.\n\nWhat it is: CVE-2026-97902 is a denial of service vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-97902 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97902/ (Markdown: https://insights.sbomify.com/CVE-2026-97902/index.md)","id":"CVE-2026-97902","markdown":"https://insights.sbomify.com/CVE-2026-97902/index.md","name":"CVE-2026-97902","record":{"aliases":["BELL-CVE-2026-97902","DEBIAN-CVE-2026-97902","GHSA-vh56-x82h-2pwm","UBUNTU-CVE-2026-97902"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A logic error in Linux kernel filesystem freezing causes block devices to remain permanently frozen, preventing remounting and causing denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs: don't return -EINVAL for successful nested thaw\n\nCommit 7366f8b6fc6a (\"fs: handle freezing from multiple devices\")\nreplaced the freeze_holders bitmask with per-holder counters to allow\nnested freezes. In the bitmask version, a thaw that released a shared\nhold while another holder remained returned 0. Since the rework,\nthaw_super_locked() drops the freeze reference via freeze_dec() but\nthen returns -EINVAL when other freezers remain, misinforming the\ncaller: the thaw did succeed, the superblock just stays frozen for the\nremaining holders.\n\nThis breaks bdev-initiated freezing. When a filesystem is frozen with\nFIFREEZE and additionally frozen via bdev_freeze() -- which nests by\ndesign, see fs_bdev_freeze() -- the subsequent bdev_thaw() receives\n-EINVAL from the holder op although its freeze reference was dropped,\nand therefore keeps bd_fsfreeze_count elevated. Then device-mapper's\nunlock_fs() ignores bdev_thaw()'s return value, so nothing rebalances\nthe count. After the user's FITHAW and umount, the block device can\nnever be mounted again:\n\n    dm-1: Can't mount, blockdev is frozen\n\nThere is no way for userspace to drop the leaked count; only\ndestroying the block device (or a reboot) recovers the device.\n\nReproducer (any kernel since v6.8):\n\n    dmsetup create dut --table \"0 $(blockdev --getsz \"$DEV\") linear $DEV 0\"\n    mkfs.ext4 /dev/mapper/dut\n    mount /dev/mapper/dut /mnt\n    fsfreeze --freeze /mnt      # freeze_ucount == 1\n    dmsetup suspend dut         # bd_fsfreeze_count == 1, ucount == 2\n    dmsetup resume dut          # ucount 2 -\u003e 1, but thaw_super()\n                                # returns -EINVAL, so bdev_thaw()\n                                # keeps bd_fsfreeze_count at 1\n    fsfreeze --unfreeze /mnt    # filesystem thaws fine\n    umount /mnt\n    mount /dev/mapper/dut /mnt  # EBUSY, forever\n\nThe same happens with fsfreeze held across an LVM snapshot of the\norigin volume.\n\nfs_bdev_thaw()'s documentation already describes the intended\nsemantics: \"If this function returns zero it doesn't mean that the\nfilesystem is unfrozen as it may have been frozen multiple times\".\nRestore them by returning 0 when a nested thaw drops its hold while\nother freezers remain. Thawing without holding a freeze still fails\nwith -EINVAL as may_unfreeze() rejects that case before the reference\ncount is touched.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"fs: don't return -EINVAL for successful nested thaw","id":"CVE-2026-97902","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"exit: hold a reference to thread_pid across proc_flush_pid","id":"CVE-2026-97903"},"packages":[],"prev":{"headline":"genetlink: pin family module during policy dump","id":"CVE-2026-97901"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A logic error in Linux kernel filesystem freezing causes block devices to remain permanently frozen, preventing remounting and causing denial of service.","url":"https://insights.sbomify.com/CVE-2026-97902/"}