LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46061: jbd2: fix deadlock in jbd2_journal_cancel_revoke()

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix deadlock in jbd2_journal_cancel_revoke() Commit f76d4c28a46a ("fs/jbd2: use sleeping version of __find_get_block()") changed jbd2_journal_cancel_revoke() to use __find_get_block_nonatomic() which holds the folio lock instead of i_private_lock. This breaks the lock ordering (folio -> buffer) and causes an ABBA deadlock when the filesystem blocksize < pagesize: T1 T2 ext4_mkdir() ext4_init_new_dir() ext4_append() ext4_getblk() lock_buffer() <- A sync_blockdev() blkdev_writepages() writeback_iter() writeback_get_folio() folio_lock() <- B ext4_journal_get_create_access() jbd2_journal_cancel_revoke() __find_get_block_nonatomic() folio_lock() <- B block_write_full_folio() lock_buffer() <- A This can occasionally cause generic/013 to hang. Fix by only calling __find_get_block_nonatomic() when the passed buffer_head doesn't belong to the bdev, which is the only case that we need to look up its bdev alias. Otherwise, the lookup is redundant since the found buffer_head is equal to the one we passed in.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-46061 is a Linux kernel deadlock in the jbd2 journaling code used by ext4. In certain filesystem conditions, the kernel can hang during normal filesystem activity. The disclosed impact is availability, not data theft or remote compromise.

Executive priority

Treat as a planned availability fix, higher priority for critical Linux servers using ext4. There is no sourced evidence of active exploitation, but kernel deadlocks can cause service disruption and may require reboot recovery.

Technical view

A change to jbd2_journal_cancel_revoke() used __find_get_block_nonatomic(), altering lock ordering to folio then buffer. When filesystem block size is smaller than page size, concurrent ext4 operations and writeback can hit an ABBA deadlock. The kernel fix avoids the redundant bdev alias lookup when unnecessary.

Likely exposure

Exposure is most relevant to Linux systems using affected kernel versions with ext4/jbd2 and filesystems where block size is smaller than page size. The CVE record lists Linux kernel version ranges and stable commits, but distro-specific affected package status is not provided.

Exploitation context

No active exploitation is indicated by the provided sources, and the CVE is not listed as KEV. The source describes occasional hangs in a kernel filesystem test, suggesting a reliability and denial-of-service concern rather than a known weaponized issue.

Researcher notes

The root cause is lock-order inversion introduced by commit f76d4c28a46a. The fix conditionally avoids __find_get_block_nonatomic() when the passed buffer_head already belongs to the block device. Public data lacks CVSS, CWE, and distro package mappings.

Mitigation direction

  • Check your Linux distribution or kernel vendor advisory for CVE-2026-46061 status.
  • Update to a kernel build containing the referenced stable jbd2 fix commits.
  • Prioritize systems using ext4 where filesystem block size is smaller than page size.
  • Use vendor-supported kernels rather than applying isolated kernel patches manually.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and container hosts.
  • Identify systems using ext4 filesystems backed by jbd2 journaling.
  • Compare installed kernel builds against vendor advisories and referenced stable commits.
  • Review system logs for unexplained filesystem hangs or blocked writeback symptoms.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46061 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf1c5aa614b5c251f93a6a4c8c26001d5e9e53fd6, f76d4c28a46a9260d85e00dafc8f46d369365d33, f76d4c28a46a9260d85e00dafc8f46d369365d33, f76d4c28a46a9260d85e00dafc8f46d369365d33, 1bb7a4b6b3d7dd8da6f5a9d0529d42c22a359e71, 6.12.31, 6.14.9unaffected
LinuxLinux6.15, 0, 6.12.86, 6.18.27, 7.0.4, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.