CVE-2026-53050
quota: Fix race of dquot_scan_active() with quota deactivation
Description
In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_active() with quota deactivation dquot_scan_active() can race with quota deactivation in quota_release_workfn() like: CPU0 (quota_release_workfn) CPU1 (dquot_scan_active) ============================== ============================== spin_lock(&dq_list_lock); list_replace_init( &releasing_dquots, &rls_head); /* dquot X on rls_head, dq_count == 0, DQ_ACTIVE_B still set */ spin_unlock(&dq_list_lock); synchronize_srcu(&dquot_srcu); spin_lock(&dq_list_lock); list_for_each_entry(dquot, &inuse_list, dq_inuse) { /* finds dquot X */ dquot_active(X) -> true atomic_inc(&X->dq_count); } spin_unlock(&dq_list_lock); spin_lock(&dq_list_lock); dquot = list_first_entry(&rls_head); WARN_ON_ONCE(atomic_read(&dquot->dq_count)); The problem is not only a cosmetic one as under memory pressure the caller of dquot_scan_active() can end up working on freed dquot. Fix the problem by making sure the dquot is removed from releasing list when we acquire a reference to it.
INFO
Published Date :
June 24, 2026, 5:17 p.m.
Last Modified :
July 21, 2026, 5:23 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Ensure dquot is removed from the releasing list.
- Acquire a reference to dquot before processing.
- Apply the provided kernel patch to resolve the race condition.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53050.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53050 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53050
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53050 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53050 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 21, 2026
Action Type Old Value New Value Added CWE CWE-362 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:6.6:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.6:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.5.8 up to (excluding) 6.6 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19.297 up to (excluding) 4.20 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.199 up to (excluding) 5.10.258 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.136 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.259 up to (excluding) 5.5 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.59 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6.1 up to (excluding) 6.6.141 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2bdc80f4619411e5bd4a3ef23f51e14021ed457c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/61e25f664dc2a08299e07d84c85776abc2350f75 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6678dde265708003c2b42551af4a2e3cb05decd5 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/82cbdb4c1ebb5ea7d7bd45c18d3483b5bd32ebc1 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ac8a2e0d287ebf35e5d7e51e260b4e146648ba4a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f9438cb8c8ec3adc84b2b450a3aab0123d074c3b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/fdd424d7c35633ac577fd87d1b043d1b8a6cd350 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '22c06bf1f99ec3ec16b1a81342becba4c59a1f16', 'lessThan': '2bdc80f4619411e5bd4a3ef23f51e14021ed457c', 'versionType': 'git'}, {'status': 'affected', 'version': '56e96b38d2f7cd95b3c30eb70decac7233915e0a', 'lessThan': 'f9438cb8c8ec3adc84b2b450a3aab0123d074c3b', 'versionType': 'git'}, {'status': 'affected', 'version': '12a820a9923c11e8e898da9f82c8aded70cdcd16', 'lessThan': 'ac8a2e0d287ebf35e5d7e51e260b4e146648ba4a', 'versionType': 'git'}, {'status': 'affected', 'version': '869b6ea1609f655a43251bf41757aa44e5350a8f', 'lessThan': '6678dde265708003c2b42551af4a2e3cb05decd5', 'versionType': 'git'}, {'status': 'affected', 'version': '869b6ea1609f655a43251bf41757aa44e5350a8f', 'lessThan': '61e25f664dc2a08299e07d84c85776abc2350f75', 'versionType': 'git'}, {'status': 'affected', 'version': '869b6ea1609f655a43251bf41757aa44e5350a8f', 'lessThan': 'fdd424d7c35633ac577fd87d1b043d1b8a6cd350', 'versionType': 'git'}, {'status': 'affected', 'version': '869b6ea1609f655a43251bf41757aa44e5350a8f', 'lessThan': '82cbdb4c1ebb5ea7d7bd45c18d3483b5bd32ebc1', 'versionType': 'git'}, {'status': 'affected', 'version': '869b6ea1609f655a43251bf41757aa44e5350a8f', 'lessThan': 'e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d', 'versionType': 'git'}, {'status': 'affected', 'version': 'bb7e3a019b52d829949d02b64ebab37838148fbf', 'versionType': 'git'}, {'status': 'affected', 'version': '061a18239ced5eb086967a2b4451cb1cc5ce0702', 'versionType': 'git'}, {'status': 'affected', 'version': '2a1ddddba6541143c8f73962f3021f1789114284', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.199', 'lessThan': '5.10.258', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.15.136', 'lessThan': '5.15.209', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.59', 'lessThan': '6.1.175', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.19.297', 'lessThan': '4.20', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.4.259', 'lessThan': '5.5', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.5.8', 'lessThan': '6.6', 'versionType': 'semver'}], 'programFiles': ['fs/quota/dquot.c', 'include/linux/quotaops.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.6'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.6', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/quota/dquot.c', 'include/linux/quotaops.h'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_active() with quota deactivation dquot_scan_active() can race with quota deactivation in quota_release_workfn() like: CPU0 (quota_release_workfn) CPU1 (dquot_scan_active) ============================== ============================== spin_lock(&dq_list_lock); list_replace_init( &releasing_dquots, &rls_head); /* dquot X on rls_head, dq_count == 0, DQ_ACTIVE_B still set */ spin_unlock(&dq_list_lock); synchronize_srcu(&dquot_srcu); spin_lock(&dq_list_lock); list_for_each_entry(dquot, &inuse_list, dq_inuse) { /* finds dquot X */ dquot_active(X) -> true atomic_inc(&X->dq_count); } spin_unlock(&dq_list_lock); spin_lock(&dq_list_lock); dquot = list_first_entry(&rls_head); WARN_ON_ONCE(atomic_read(&dquot->dq_count)); The problem is not only a cosmetic one as under memory pressure the caller of dquot_scan_active() can end up working on freed dquot. Fix the problem by making sure the dquot is removed from releasing list when we acquire a reference to it. Added Reference https://git.kernel.org/stable/c/2bdc80f4619411e5bd4a3ef23f51e14021ed457c Added Reference https://git.kernel.org/stable/c/61e25f664dc2a08299e07d84c85776abc2350f75 Added Reference https://git.kernel.org/stable/c/6678dde265708003c2b42551af4a2e3cb05decd5 Added Reference https://git.kernel.org/stable/c/82cbdb4c1ebb5ea7d7bd45c18d3483b5bd32ebc1 Added Reference https://git.kernel.org/stable/c/ac8a2e0d287ebf35e5d7e51e260b4e146648ba4a Added Reference https://git.kernel.org/stable/c/e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d Added Reference https://git.kernel.org/stable/c/f9438cb8c8ec3adc84b2b450a3aab0123d074c3b Added Reference https://git.kernel.org/stable/c/fdd424d7c35633ac577fd87d1b043d1b8a6cd350