CVE-2026-31598

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix possible deadlock between unlink and dio_end_io_write

ocfs2_unlink takes orphan dir inode_lock first and then ip_alloc_sem,

while in ocfs2_dio_end_io_write, it acquires these locks in reverse order.

This creates an ABBA lock ordering violation on lock classes

ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] and

ocfs2_file_ip_alloc_sem_key.

Lock Chain #0 (orphan dir inode_lock -> ip_alloc_sem):

ocfs2_unlink

ocfs2_prepare_orphan_dir

ocfs2_lookup_lock_orphan_dir

inode_lock(orphan_dir_inode) <- lock A

__ocfs2_prepare_orphan_dir

ocfs2_prepare_dir_for_insert

ocfs2_extend_dir

ocfs2_expand_inline_dir

down_write(&oi->ip_alloc_sem) <- Lock B

Lock Chain #1 (ip_alloc_sem -> orphan dir inode_lock):

ocfs2_dio_end_io_write

down_write(&oi->ip_alloc_sem) <- Lock B

ocfs2_del_inode_from_orphan()

inode_lock(orphan_dir_inode) <- Lock A

Deadlock Scenario:

CPU0 (unlink)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References