CVE-2026-97902

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs: don't return -EINVAL for successful nested thaw

Commit 7366f8b6fc6a ("fs: handle freezing from multiple devices")

replaced the freeze_holders bitmask with per-holder counters to allow

nested freezes. In the bitmask version, a thaw that released a shared

hold while another holder remained returned 0. Since the rework,

thaw_super_locked() drops the freeze reference via freeze_dec() but

then returns -EINVAL when other freezers remain, misinforming the

caller: the thaw did succeed, the superblock just stays frozen for the

remaining holders.

This breaks bdev-initiated freezing. When a filesystem is frozen with

FIFREEZE and additionally frozen via bdev_freeze() -- which nests by

design, see fs_bdev_freeze() -- the subsequent bdev_thaw() receives

-EINVAL from the holder op although its freeze reference was dropped,

and therefore keeps bd_fsfreeze_count elevated. Then device-mapper's

unlock_fs() ignores bdev_thaw()'s re

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References