CVE-2026-97902

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97902", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.200Z", "datePublished": "2026-09-25T10:22:29.259Z", "dateUpdated": "2026-10-19T09:10:28.572Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:10:28.572Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: don't return -EINVAL for successful nested thaw\n\nCommit 7366f8b6fc6a (\"fs: handle freezing from multiple devices\")\nreplaced the freeze_holders bitmask with per-holder counters to allow\nnested freezes. In the bitmask version, a thaw that released a shared\nhold while another holder remained returned 0. Since the rework,\nthaw_super_locked() drops the freeze reference via freeze_dec() but\nthen returns -EINVAL when other freezers remain, misinforming the\ncaller: the thaw did succeed, the superblock just stays frozen for the\nremaining holders.\n\nThis breaks bdev-initiated freezing. When a filesystem is frozen with\nFIFREEZE and additionally frozen via bdev_freeze() -- which nests by\ndesign, see fs_bdev_freeze() -- the subsequent bdev_thaw() receives\n-EINVAL from the holder op although its freeze reference was dropped,\nand therefore keeps bd_fsfreeze_count elevated. Then device-mapper's\nunlock_fs() ignores bdev_thaw()'s return value, so nothing rebalances\nthe count. After the user's FITHAW and umount, the block device can\nnever be mounted again:\n\n dm-1: Can't mount, blockdev is frozen\n\nThere is no way for userspace to drop the leaked count; only\ndestroying the block device (or a reboot) recovers the device.\n\nReproducer (any kernel since v6.8):\n\n dmsetup create dut --table \"0 $(blockdev --getsz \"$DEV\") linear $DEV 0\"\n mkfs.ext4 /dev/mapper/dut\n mount /dev/mapper/dut /mnt\n fsfreeze --freeze /mnt # freeze_ucount == 1\n dmsetup suspend dut # bd_fsfreeze_count == 1, ucount == 2\n dmsetup resume dut # ucount 2 -> 1, but thaw_super()\n # returns -EINVAL, so bdev_thaw()\n # keeps bd_fsfreeze_count at 1\n fsfreeze --unfreeze /mnt # filesystem thaws fine\n umount /mnt\n mount /dev/mapper/dut /mnt # EBUSY, forever\n\nThe same happens with fsfreeze held across an LVM snapshot of the\norigin volume.\n\nfs_bdev_thaw()'s documentation already describes the intended\nsemantics: \"If this function returns zero it doesn't mean that the\nfilesystem is unfrozen as it may have been frozen multiple times\".\nRestore them by returning 0 when a nested thaw drops its hold while\nother freezers remain. Thawing without holding a freeze still fails\nwith -EINVAL as may_unfreeze() rejects that case before the reference\ncount is touched."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/super.c"], "versions": [{"version": "7366f8b6fc6aa21c4199cb5d337b023df69745b0", "lessThan": "111339816138f042a59778322f941edc26903484", "status": "affected", "versionType": "git"}, {"version": "7366f8b6fc6aa21c4199cb5d337b023df69745b0", "lessThan": "76e478499913dc1f368aebe85b28b7d1265985ff", "status": "affected", "versionType": "git"}, {"version": "7366f8b6fc6aa21c4199cb5d337b023df69745b0", "lessThan": "ff2a694f6613d54ebd77ba72583d4d94446f55bd", "status": "affected", "versionType": "git"}, {"version": "7366f8b6fc6aa21c4199cb5d337b023df69745b0", "lessThan": "fe967191e5851ea79818c5fe4e781c3882139218", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/super.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/111339816138f042a59778322f941edc26903484"}, {"url": "https://git.kernel.org/stable/c/76e478499913dc1f368aebe85b28b7d1265985ff"}, {"url": "https://git.kernel.org/stable/c/ff2a694f6613d54ebd77ba72583d4d94446f55bd"}, {"url": "https://git.kernel.org/stable/c/fe967191e5851ea79818c5fe4e781c3882139218"}], "title": "fs: don't return -EINVAL for successful nested thaw", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "111339816138f042a59778322f941edc26903484", "status": "affected", "version": "7366f8b6fc6aa21c4199cb5d337b023df69745b0", "versionType": "git"}, {"lessThan": "76e478499913dc1f368aebe85b28b7d1265985ff", "status": "affected", "version": "7366f8b6fc6aa21c4199cb5d337b023df69745b0", "versionType": "git"}, {"lessThan": "ff2a694f6613d54ebd77ba72583d4d94446f55bd", "status": "affected", "version": "7366f8b6fc6aa21c4199cb5d337b023df69745b0", "versionType": "git"}, {"lessThan": "fe967191e5851ea79818c5fe4e781c3882139218", "status": "affected", "version": "7366f8b6fc6aa21c4199cb5d337b023df69745b0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: don't return -EINVAL for successful nested thaw\n\nCommit 7366f8b6fc6a (\"fs: handle freezing from multiple devices\")\nreplaced the freeze_holders bitmask with per-holder counters to allow\nnested freezes. In the bitmask version, a thaw that released a shared\nhold while another holder remained returned 0. Since the rework,\nthaw_super_locked() drops the freeze reference via freeze_dec() but\nthen returns -EINVAL when other freezers remain, misinforming the\ncaller: the thaw did succeed, the superblock just stays frozen for the\nremaining holders.\n\nThis breaks bdev-initiated freezing. When a filesystem is frozen with\nFIFREEZE and additionally frozen via bdev_freeze() -- which nests by\ndesign, see fs_bdev_freeze() -- the subsequent bdev_thaw() receives\n-EINVAL from the holder op although its freeze reference was dropped,\nand therefore keeps bd_fsfreeze_count elevated. Then device-mapper's\nunlock_fs() ignores bdev_thaw()'s return value, so nothing rebalances\nthe count. After the user's FITHAW and umount, the block device can\nnever be mounted again:\n\n dm-1: Can't mount, blockdev is frozen\n\nThere is no way for userspace to drop the leaked count; only\ndestroying the block device (or a reboot) recovers the device.\n\nReproducer (any kernel since v6.8):\n\n dmsetup create dut --table \"0 $(blockdev --getsz \"$DEV\") linear $DEV 0\"\n mkfs.ext4 /dev/mapper/dut\n mount /dev/mapper/dut /mnt\n fsfreeze --freeze /mnt # freeze_ucount == 1\n dmsetup suspend dut # bd_fsfreeze_count == 1, ucount == 2\n dmsetup resume dut # ucount 2 -> 1, but thaw_super()\n # returns -EINVAL, so bdev_thaw()\n # keeps bd_fsfreeze_count at 1\n fsfreeze --unfreeze /mnt # filesystem thaws fine\n umount /mnt\n mount /dev/mapper/dut /mnt # EBUSY, forever\n\nThe same happens with fsfreeze held across an LVM snapshot of the\norigin volume.\n\nfs_bdev_thaw()'s documentation already describes the intended\nsemantics: \"If this function returns zero it doesn't mean that the\nfilesystem is unfrozen as it may have been frozen multiple times\".\nRestore them by returning 0 when a nested thaw drops its hold while\nother freezers remain. Thawing without holding a freeze still fails\nwith -EINVAL as may_unfreeze() rejects that case before the reference\ncount is touched."}], "id": "CVE-2026-97902", "lastModified": "2026-10-19T10:17:40.403", "metrics": {}, "published": "2026-09-25T11:17:17.000", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/111339816138f042a59778322f941edc26903484"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/76e478499913dc1f368aebe85b28b7d1265985ff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fe967191e5851ea79818c5fe4e781c3882139218"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ff2a694f6613d54ebd77ba72583d4d94446f55bd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: fs: don't return -EINVAL for successful nested thaw", "id": "2541313", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541313"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-393", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfs: don't return -EINVAL for successful nested thaw\nCommit 7366f8b6fc6a (\"fs: handle freezing from multiple devices\")\nreplaced the freeze_holders bitmask with per-holder counters to allow\nnested freezes. In the bitmask version, a thaw that released a shared\nhold while another holder remained returned 0. Since the rework,\nthaw_super_locked() drops the freeze reference via freeze_dec() but\nthen returns -EINVAL when other freezers remain, misinforming the\ncaller: the thaw did succeed, the superblock just stays frozen for the\nremaining holders.\nThis breaks bdev-initiated freezing. When a filesystem is frozen with\nFIFREEZE and additionally frozen via bdev_freeze() -- which nests by\ndesign, see fs_bdev_freeze() -- the subsequent bdev_thaw() receives\n-EINVAL from the holder op although its freeze reference was dropped,\nand therefore keeps bd_fsfreeze_count elevated. Then device-mapper's\nunlock_fs() ignores bdev_thaw()'s return value, so nothing rebalances\nthe count. After the user's FITHAW and umount, the block device can\nnever be mounted again:\ndm-1: Can't mount, blockdev is frozen\nThere is no way for userspace to drop the leaked count; only\ndestroying the block device (or a reboot) recovers the device.\nReproducer (any kernel since v6.8):\ndmsetup create dut --table \"0 $(blockdev --getsz \"$DEV\") linear $DEV 0\"\nmkfs.ext4 /dev/mapper/dut\nmount /dev/mapper/dut /mnt\nfsfreeze --freeze /mnt # freeze_ucount == 1\ndmsetup suspend dut # bd_fsfreeze_count == 1, ucount == 2\ndmsetup resume dut # ucount 2 -> 1, but thaw_super()\n# returns -EINVAL, so bdev_thaw()\n# keeps bd_fsfreeze_count at 1\nfsfreeze --unfreeze /mnt # filesystem thaws fine\numount /mnt\nmount /dev/mapper/dut /mnt # EBUSY, forever\nThe same happens with fsfreeze held across an LVM snapshot of the\norigin volume.\nfs_bdev_thaw()'s documentation already describes the intended\nsemantics: \"If this function returns zero it doesn't mean that the\nfilesystem is unfrozen as it may have been frozen multiple times\".\nRestore them by returning 0 when a nested thaw drops its hold while\nother freezers remain. Thawing without holding a freeze still fails\nwith -EINVAL as may_unfreeze() rejects that case before the reference\ncount is touched.", "A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) by initiating nested filesystem freeze and thaw operations. An incorrect error code returned during nested thaw requests causes the kernel to retain an elevated freeze counter on the underlying block device. Consequently, the device remains permanently locked in a frozen state after being unmounted, preventing subsequent mount operations until the device is re-created or the system is rebooted."], "name": "CVE-2026-97902", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97902\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97902\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97902.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7366f8b6fc6aa21c4199cb5d337b023df69745b0,111339816138f042a59778322f941edc26903484)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7366f8b6fc6aa21c4199cb5d337b023df69745b0,76e478499913dc1f368aebe85b28b7d1265985ff)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7366f8b6fc6aa21c4199cb5d337b023df69745b0,ff2a694f6613d54ebd77ba72583d4d94446f55bd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7366f8b6fc6aa21c4199cb5d337b023df69745b0,fe967191e5851ea79818c5fe4e781c3882139218)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T20:00:08.969475+00:00", "updated": "2026-10-01T07:00:03.046511+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-393", "CWE-399"]}