Not yet scoredPublished Sep 24, 2026

CVE-2026-93269ext4: fix circular lock dependency in ext4_ext_migrate

Updated under an hour ago (Oct 27, 2026, 9:20 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ext4: fix circular lock dependency in ext4_ext_migrate Move iput(tmp_inode) after ext4_writepages_up_write() to avoid a circular lock dependency between s_writepages_rwsem and sb_internal (freeze protection). The deadlock scenario: CPU0 (EXT4_IOC_MIGRATE) CPU1 (orphan cleanup during mount) ---- ---- ext4_ext_migrate() ext4_writepages_down_write() s_writepages_rwsem (write) ext4_evict_inode() sb_start_intwrite() [sb_internal] ... ext4_writepages() s_writepages_rwsem (read) [BLOCKED] iput(tmp_inode) ext4_evict_inode() sb_start_intwrite() [BLOCKED] The tmp_inode is a temporary inode with nlink=0 created solely for building the extent tree. Its eviction does not require s_writepages_rwsem protection, so deferring iput() until after releasing the rwsem is safe.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from cb85f4d23f794e24127f3e562cb3b54b0803f456 before 452950461241dfed8b1d32e94b227db38c99c5af; from cb85f4d23f794e24127f3e562cb3b54b0803f456 before ada23457d4748d6e9c36c6f871fc29a6f558c48c; from cb85f4d23f794e24127f3e562cb3b54b0803f456 before e4223231b6860141813637a6413c2371ae4d6fa8; from cb85f4d23f794e24127f3e562cb3b54b0803f456 before 32f7ab52875ec7f800ca67e7176e5743a84baddf; from cb85f4d23f794e24127f3e562cb3b54b0803f456 before a897682793eba5de51ee6f3152760374afa629cf; eb799e163dc2bc1ea0a4820b66f79d32a5e907df; bcc1eab71a67c46b9e24544ac7923f44444174ce; 8cf20fb73e73a4c4df0328b5297842c5ef34fdd9; and 7 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/452950461241dfed8b1d32e94b227db38c99c5af
https://git.kernel.org/stable/c/ada23457d4748d6e9c36c6f871fc29a6f558c48c
https://git.kernel.org/stable/c/e4223231b6860141813637a6413c2371ae4d6fa8
https://git.kernel.org/stable/c/32f7ab52875ec7f800ca67e7176e5743a84baddf
https://git.kernel.org/stable/c/a897682793eba5de51ee6f3152760374afa629cf

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.