CVE-2026-98444: xfs: drop dquot flush lock when we can't find a buffer to flush

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfs_qm_flush_one fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is going to drop the dqflock, so we need to do it ourselves.

Affected products

Linux kernel: from 6.12.14 before 6.13; 6.13 — fixed in 6.13, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 6.13, 7.3. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/41bc624377f08125eae164c62ce043791ade93b7
https://git.kernel.org/stable/c/ffb48dccce1960a9ea24463a2f3c21d124d6b672

Get alerted when CVE-2026-98444 or the next vulnerability affects your stack