CVE-2026-68150

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/super: fix emergency thaw double-unlock of s_umount

do_thaw_all() iterates over all superblocks via __iterate_supers()

with SUPER_ITER_EXCL, which acquires s_umount exclusively before

calling the callback and releases it afterwards. However, the

callback do_thaw_all_callback() calls thaw_super_locked() which

unconditionally releases s_umount on every code path. This results

in a second unlock attempt in __iterate_supers() that corrupts the

rwsem state, triggering a DEBUG_RWSEMS warning:

[ 182.601148] sysrq: Emergency Thaw of all frozen filesystems

[ 182.601865] ------------[ cut here ]------------

[ 182.602375] DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)): count = 0x0, magic = 0xffff99b1011e5870, owner = 0x0, curr 0xffff99b101b06c80, list not empty

[ 182.603817] WARNING: kernel/locking/rwsem.c:1412 at up_write+0xa3/0x170, CPU#2: kworker/2:1/53

[ 182.60457

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References