{"cve":"CVE-2026-46061","nvd":{"published":"2026-05-27T14:17:25.883","modified":"2026-06-17T10:53:00.163","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: fix deadlock in jbd2_journal_cancel_revoke()\n\nCommit f76d4c28a46a (\"fs/jbd2: use sleeping version of\n__find_get_block()\") changed jbd2_journal_cancel_revoke() to use\n__find_get_block_nonatomic() which holds the folio lock instead of\ni_private_lock. This breaks the lock ordering (folio -> buffer) and\ncauses an ABBA deadlock when the filesystem blocksize < pagesize:\n\n     T1                                T2\next4_mkdir()\n ext4_init_new_dir()\n  ext4_append()\n   ext4_getblk()\n    lock_buffer()    <- A\n                                   sync_blockdev()\n                                    blkdev_writepages()\n                                     writeback_iter()\n                                      writeback_get_folio()\n                                       folio_lock()   <- B\n     ext4_journal_get_create_access()\n      jbd2_journal_cancel_revoke()\n       __find_get_block_nonatomic()\n        folio_lock()  <- B\n                                     block_write_full_folio()\n                                      lock_buffer()   <- A\n\nThis can occasionally cause generic/013 to hang.\n\nFix by only calling __find_get_block_nonatomic() when the passed\nbuffer_head doesn't belong to the bdev, which is the only case that we\nneed to look up its bdev alias. Otherwise, the lookup is redundant since\nthe found buffer_head is equal to the one we passed in.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-667"],"references":["https://git.kernel.org/stable/c/2b2fee890250ab647a601124471a334bb01a0790","https://git.kernel.org/stable/c/981fcc5674e67158d24d23e841523eccba19d0e7","https://git.kernel.org/stable/c/bbd943d6a2d566428324b516a37f98328dfb802d","https://git.kernel.org/stable/c/dff07cc98fdf6af57a7c054dc09b2050a9d5c287"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:36:28.938604137+00:00"},"epss":{"cve":"CVE-2026-46061","score":0.00094,"percentile":0.00574,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}