CVE-2026-31598 (GCVE-0-2026-31598)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:42 – Updated: 2026-08-05 12:23
VLAI
Title
ocfs2: fix possible deadlock between unlink and dio_end_io_write
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible deadlock between unlink and dio_end_io_write ocfs2_unlink takes orphan dir inode_lock first and then ip_alloc_sem, while in ocfs2_dio_end_io_write, it acquires these locks in reverse order. This creates an ABBA lock ordering violation on lock classes ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] and ocfs2_file_ip_alloc_sem_key. Lock Chain #0 (orphan dir inode_lock -> ip_alloc_sem): ocfs2_unlink ocfs2_prepare_orphan_dir ocfs2_lookup_lock_orphan_dir inode_lock(orphan_dir_inode) <- lock A __ocfs2_prepare_orphan_dir ocfs2_prepare_dir_for_insert ocfs2_extend_dir ocfs2_expand_inline_dir down_write(&oi->ip_alloc_sem) <- Lock B Lock Chain #1 (ip_alloc_sem -> orphan dir inode_lock): ocfs2_dio_end_io_write down_write(&oi->ip_alloc_sem) <- Lock B ocfs2_del_inode_from_orphan() inode_lock(orphan_dir_inode) <- Lock A Deadlock Scenario: CPU0 (unlink) CPU1 (dio_end_io_write) ------ ------ inode_lock(orphan_dir_inode) down_write(ip_alloc_sem) down_write(ip_alloc_sem) inode_lock(orphan_dir_inode) Since ip_alloc_sem is to protect allocation changes, which is unrelated with operations in ocfs2_del_inode_from_orphan. So move ocfs2_del_inode_from_orphan out of ip_alloc_sem to fix the deadlock.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a86a72a4a4e0ec109a98e2737948864ed6794bf7 , < 297d8d7bb6a2bf133d3a3636edbdf94101cbd719 (git)
Affected: a86a72a4a4e0ec109a98e2737948864ed6794bf7 , < 32630dee18c6bb2175c8a865a474749492eaf19c (git)
Affected: a86a72a4a4e0ec109a98e2737948864ed6794bf7 , < 93f35419eb84d58820040642cb6e7528fe4aba7a (git)
Affected: a86a72a4a4e0ec109a98e2737948864ed6794bf7 , < 4b80b5a838a32437f2cae0662578bac216a2c51a (git)
Affected: a86a72a4a4e0ec109a98e2737948864ed6794bf7 , < 2b884d52273c60c298bd570163e8053657bbaff6 (git)
Affected: a86a72a4a4e0ec109a98e2737948864ed6794bf7 , < bc0fb5c7d54c78be43a536df0e20dee32adb27d3 (git)
Affected: a86a72a4a4e0ec109a98e2737948864ed6794bf7 , < f9fb1a7b635849322e1d7b7b6b26389778ec8e82 (git)
Affected: a86a72a4a4e0ec109a98e2737948864ed6794bf7 , < e049f7a9bd80b7319590789ea5e1c523d6339d91 (git)
Affected: a86a72a4a4e0ec109a98e2737948864ed6794bf7 , < b02da26a992db0c0e2559acbda0fc48d4a2fd337 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.136 , ≤ 6.6.* (semver)
Unaffected: 6.12.83 , ≤ 6.12.* (semver)
Unaffected: 6.18.24 , ≤ 6.18.* (semver)
Unaffected: 6.19.14 , ≤ 6.19.* (semver)
Unaffected: 7.0.1 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/aops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "297d8d7bb6a2bf133d3a3636edbdf94101cbd719",
              "status": "affected",
              "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
              "versionType": "git"
            },
            {
              "lessThan": "32630dee18c6bb2175c8a865a474749492eaf19c",
              "status": "affected",
              "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
              "versionType": "git"
            },
            {
              "lessThan": "93f35419eb84d58820040642cb6e7528fe4aba7a",
              "status": "affected",
              "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
              "versionType": "git"
            },
            {
              "lessThan": "4b80b5a838a32437f2cae0662578bac216a2c51a",
              "status": "affected",
              "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
              "versionType": "git"
            },
            {
              "lessThan": "2b884d52273c60c298bd570163e8053657bbaff6",
              "status": "affected",
              "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
              "versionType": "git"
            },
            {
              "lessThan": "bc0fb5c7d54c78be43a536df0e20dee32adb27d3",
              "status": "affected",
              "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
              "versionType": "git"
            },
            {
              "lessThan": "f9fb1a7b635849322e1d7b7b6b26389778ec8e82",
              "status": "affected",
              "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
              "versionType": "git"
            },
            {
              "lessThan": "e049f7a9bd80b7319590789ea5e1c523d6339d91",
              "status": "affected",
              "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
              "versionType": "git"
            },
            {
              "lessThan": "b02da26a992db0c0e2559acbda0fc48d4a2fd337",
              "status": "affected",
              "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/aops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix possible deadlock between unlink and dio_end_io_write\n\nocfs2_unlink takes orphan dir inode_lock first and then ip_alloc_sem,\nwhile in ocfs2_dio_end_io_write, it acquires these locks in reverse order.\nThis creates an ABBA lock ordering violation on lock classes\nocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] and\nocfs2_file_ip_alloc_sem_key.\n\nLock Chain #0 (orphan dir inode_lock -\u003e ip_alloc_sem):\nocfs2_unlink\n  ocfs2_prepare_orphan_dir\n    ocfs2_lookup_lock_orphan_dir\n      inode_lock(orphan_dir_inode) \u003c- lock A\n    __ocfs2_prepare_orphan_dir\n      ocfs2_prepare_dir_for_insert\n        ocfs2_extend_dir\n\t  ocfs2_expand_inline_dir\n\t    down_write(\u0026oi-\u003eip_alloc_sem) \u003c- Lock B\n\nLock Chain #1 (ip_alloc_sem -\u003e orphan dir inode_lock):\nocfs2_dio_end_io_write\n  down_write(\u0026oi-\u003eip_alloc_sem) \u003c- Lock B\n  ocfs2_del_inode_from_orphan()\n    inode_lock(orphan_dir_inode) \u003c- Lock A\n\nDeadlock Scenario:\n  CPU0 (unlink)                     CPU1 (dio_end_io_write)\n  ------                            ------\n  inode_lock(orphan_dir_inode)\n                                    down_write(ip_alloc_sem)\n  down_write(ip_alloc_sem)\n                                    inode_lock(orphan_dir_inode)\n\nSince ip_alloc_sem is to protect allocation changes, which is unrelated\nwith operations in ocfs2_del_inode_from_orphan.  So move\nocfs2_del_inode_from_orphan out of ip_alloc_sem to fix the deadlock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Although the core bug is in ocfs2 filesystem code, ocfs2 is exportable and nfsd can issue direct writes with IOCB_DIRECT while remote REMOVE operations reach vfs_unlink, making the vulnerable lock chains reachable over the network on a writable exported ocfs2 volume.\nAC:L - The bug is an ABBA deadlock where the attacker can drive both sides with concurrent extending direct writes and unlink/remove operations. Once the target deployment exposes those operations, winning the race is attacker-controlled.\nPR:N - A remote NFS client can trigger the operations through an exported writable share without kernel capabilities on the target. In permissive or anonymous export scenarios, no prior authenticated privileges are required.\nUI:N - No victim user action is required after the vulnerable service/filesystem is available. The attacker can send the write and remove operations directly.\nS:U - The impact remains within the same kernel/filesystem security authority. There is no VM escape, sandbox boundary crossing, or separate security scope.\nC:N - The issue is a lock-ordering deadlock, not memory corruption or information disclosure. It does not provide a read primitive or leak data.\nI:N - The vulnerable behavior does not corrupt memory or allow unauthorized data modification. It only causes threads to block on locks.\nA:H - The deadlock can permanently hang ocfs2 operations and affected kernel worker/syscall contexts. A kernel/filesystem hang is a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:42.417Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/297d8d7bb6a2bf133d3a3636edbdf94101cbd719"
        },
        {
          "url": "https://git.kernel.org/stable/c/32630dee18c6bb2175c8a865a474749492eaf19c"
        },
        {
          "url": "https://git.kernel.org/stable/c/93f35419eb84d58820040642cb6e7528fe4aba7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b80b5a838a32437f2cae0662578bac216a2c51a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b884d52273c60c298bd570163e8053657bbaff6"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc0fb5c7d54c78be43a536df0e20dee32adb27d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9fb1a7b635849322e1d7b7b6b26389778ec8e82"
        },
        {
          "url": "https://git.kernel.org/stable/c/e049f7a9bd80b7319590789ea5e1c523d6339d91"
        },
        {
          "url": "https://git.kernel.org/stable/c/b02da26a992db0c0e2559acbda0fc48d4a2fd337"
        }
      ],
      "title": "ocfs2: fix possible deadlock between unlink and dio_end_io_write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31598",
    "datePublished": "2026-04-24T14:42:23.304Z",
    "dateReserved": "2026-03-09T15:48:24.121Z",
    "dateUpdated": "2026-08-05T12:23:42.417Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31598",
      "date": "2026-09-29",
      "epss": "0.00622",
      "percentile": "0.47769"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-02T01:41:49.000Z",
      "cve": "CVE-2026-31598",
      "id": "msrc_CVE-2026-31598",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ocfs2: fix possible deadlock between unlink and dio_end_io_write",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31598.json",
      "version": "6"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/aops.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "297d8d7bb6a2bf133d3a3636edbdf94101cbd719",
                    "status": "affected",
                    "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "32630dee18c6bb2175c8a865a474749492eaf19c",
                    "status": "affected",
                    "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "93f35419eb84d58820040642cb6e7528fe4aba7a",
                    "status": "affected",
                    "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4b80b5a838a32437f2cae0662578bac216a2c51a",
                    "status": "affected",
                    "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2b884d52273c60c298bd570163e8053657bbaff6",
                    "status": "affected",
                    "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bc0fb5c7d54c78be43a536df0e20dee32adb27d3",
                    "status": "affected",
                    "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f9fb1a7b635849322e1d7b7b6b26389778ec8e82",
                    "status": "affected",
                    "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e049f7a9bd80b7319590789ea5e1c523d6339d91",
                    "status": "affected",
                    "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b02da26a992db0c0e2559acbda0fc48d4a2fd337",
                    "status": "affected",
                    "version": "a86a72a4a4e0ec109a98e2737948864ed6794bf7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/aops.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.6"
                  },
                  {
                    "lessThan": "4.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.258",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.83",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.24",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7A6CE177-C7BA-4E34-9D61-035565B5FFF5",
                    "versionEndExcluding": "6.6.136",
                    "versionStartIncluding": "4.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8",
                    "versionEndExcluding": "6.12.83",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555",
                    "versionEndExcluding": "6.18.24",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB",
                    "versionEndExcluding": "6.19.14",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A",
                    "versionEndExcluding": "7.0.1",
                    "versionStartIncluding": "7.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix possible deadlock between unlink and dio_end_io_write\n\nocfs2_unlink takes orphan dir inode_lock first and then ip_alloc_sem,\nwhile in ocfs2_dio_end_io_write, it acquires these locks in reverse order.\nThis creates an ABBA lock ordering violation on lock classes\nocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] and\nocfs2_file_ip_alloc_sem_key.\n\nLock Chain #0 (orphan dir inode_lock -\u003e ip_alloc_sem):\nocfs2_unlink\n  ocfs2_prepare_orphan_dir\n    ocfs2_lookup_lock_orphan_dir\n      inode_lock(orphan_dir_inode) \u003c- lock A\n    __ocfs2_prepare_orphan_dir\n      ocfs2_prepare_dir_for_insert\n        ocfs2_extend_dir\n\t  ocfs2_expand_inline_dir\n\t    down_write(\u0026oi-\u003eip_alloc_sem) \u003c- Lock B\n\nLock Chain #1 (ip_alloc_sem -\u003e orphan dir inode_lock):\nocfs2_dio_end_io_write\n  down_write(\u0026oi-\u003eip_alloc_sem) \u003c- Lock B\n  ocfs2_del_inode_from_orphan()\n    inode_lock(orphan_dir_inode) \u003c- Lock A\n\nDeadlock Scenario:\n  CPU0 (unlink)                     CPU1 (dio_end_io_write)\n  ------                            ------\n  inode_lock(orphan_dir_inode)\n                                    down_write(ip_alloc_sem)\n  down_write(ip_alloc_sem)\n                                    inode_lock(orphan_dir_inode)\n\nSince ip_alloc_sem is to protect allocation changes, which is unrelated\nwith operations in ocfs2_del_inode_from_orphan.  So move\nocfs2_del_inode_from_orphan out of ip_alloc_sem to fix the deadlock."
          }
        ],
        "id": "CVE-2026-31598",
        "lastModified": "2026-06-17T10:34:03.533",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-04-24T15:16:37.560",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/297d8d7bb6a2bf133d3a3636edbdf94101cbd719"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2b884d52273c60c298bd570163e8053657bbaff6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/32630dee18c6bb2175c8a865a474749492eaf19c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4b80b5a838a32437f2cae0662578bac216a2c51a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/93f35419eb84d58820040642cb6e7528fe4aba7a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b02da26a992db0c0e2559acbda0fc48d4a2fd337"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bc0fb5c7d54c78be43a536df0e20dee32adb27d3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e049f7a9bd80b7319590789ea5e1c523d6339d91"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f9fb1a7b635849322e1d7b7b6b26389778ec8e82"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-667"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:26:43+00:00",
      "cve": "CVE-2026-31598",
      "id": "CVE-2026-31598",
      "initial_release_date": "2026-04-24T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ocfs2: fix possible deadlock between unlink and dio_end_io_write",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31598.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-23T23:49:06Z",
      "cve": "CVE-2026-31598",
      "id": "CVE-2026-31598",
      "initial_release_date": "2026-04-25T01:38:24Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "559",
      "product_status:recommended": "469",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31598",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31598.json",
      "version": "23"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.