CVE-2026-45895

In the Linux kernel, the following vulnerability has been resolved:

quota: fix livelock between quotactl and freeze_super

When a filesystem is frozen, quotactlblock() enters a retry loop waiting for the filesystem to thaw. It acquires sumount, checks the freeze state, drops sumount and uses sbstartwrite() - sbend_write() pair to wait for the unfreeze.

However, this retry loop can trigger a livelock issue, specifically on kernels with preemption disabled.

The mechanism is as follows: 1. freezesuper() sets SBFREEZEWRITE and calls sbwaitwrite(). 2. sbwaitwrite() calls percpudownwrite(), which initiates synchronizercu(). 3. Simultaneously, quotactlblock() spins in its retry loop, immediately executing the sbstartwrite() - sbendwrite() pair. 4. Because the kernel is non-preemptible and the loop contains no scheduling points, quotactlblock() never yields the CPU. This prevents that CPU from reaching an RCU quiescent state. 5. synchronizercu() in the freezer thread waits indefinitely for the quotactlblock() CPU to report a quiescent state. 6. quotactl_block() spins indefinitely waiting for the freezer to advance, which it cannot do as it is blocked on the RCU sync.

This results in a hang of the freezer process and 100% CPU usage by the quota process.

While this can occur intermittently on multi-core systems, it is reliably reproducing on a node with the following script, running both the freezer and the quota toggle on the same CPU:

# mkfs.ext4 -O quota /dev/sda 2g && mkdir amount # mount /dev/sda -o quota,usrquota,grpquota amount # taskset -c 3 bash -c "while true; do xfsfreeze -f amount; \ xfsfreeze -u amount; done" & # taskset -c 3 bash -c "while true; do quotaon amount; \ quotaoff amount; done" &

Adding condresched() to the retry loop fixes the issue. It acts as an RCU quiescent state, allowing synchronizercu() in percpudownwrite() to complete.