{"id":"CVE-2026-53050","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nquota: Fix race of dquot_scan_active() with quota deactivation\n\ndquot_scan_active() can race with quota deactivation in\nquota_release_workfn() like:\n\n  CPU0 (quota_rele…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nquota: Fix race of dquot_scan_active() with quota deactivation\n\ndquot_scan_active() can race with quota deactivation in\nquota_release_workfn() like:\n\n  CPU0 (quota_rele…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-362"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.19.297, < 4.20","linux_kernel >= 5.4.259, < 5.5","linux_kernel >= 5.10.199, < 5.10.258","linux_kernel >= 5.15.136, < 5.15.209","linux_kernel >= 6.1.59, < 6.1.175","linux_kernel >= 6.5.8, < 6.6","linux_kernel >= 6.6.1, < 6.6.141","linux_kernel >= 6.7, < 6.12.91","linux_kernel >= 6.13, < 6.18.33","linux_kernel >= 6.19, < 7.0.10","linux_kernel = 6.6"],"patched":["linux_kernel 7.0.10"],"published":"2026-06-24","updated":"2026-09-08","sourceUpdated":"2026-09-08T09:18:14.037","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53050","references":[{"url":"https://git.kernel.org/stable/c/2bdc80f4619411e5bd4a3ef23f51e14021ed457c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61e25f664dc2a08299e07d84c85776abc2350f75","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6678dde265708003c2b42551af4a2e3cb05decd5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82cbdb4c1ebb5ea7d7bd45c18d3483b5bd32ebc1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac8a2e0d287ebf35e5d7e51e260b4e146648ba4a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9438cb8c8ec3adc84b2b450a3aab0123d074c3b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdd424d7c35633ac577fd87d1b043d1b8a6cd350","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00138,"epssPercentile":0.02605,"ingestedAt":"2026-09-08T13:33:25.473Z","slug":"CVE-2026-53050","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nquota: Fix race of dquot_scan_active() with quota deactivation\n\ndquot_scan_active() can race with quota deactivation in\nquota_release_workfn() like:\n\n  CPU0 (quota_release_workfn)         CPU1 (dquot_scan_active)\n  ==============================      ==============================\n  spin_lock(&dq_list_lock);\n  list_replace_init(\n    &releasing_dquots, &rls_head);\n    /* dquot X on rls_head,\n       dq_count == 0,\n       DQ_ACTIVE_B still set */\n  spin_unlock(&dq_list_lock);\n  synchronize_srcu(&dquot_srcu);\n                                      spin_lock(&dq_list_lock);\n                                      list_for_each_entry(dquot,\n                                          &inuse_list, dq_inuse) {\n                                        /* finds dquot X */\n                                        dquot_active(X) -> true\n                                        atomic_inc(&X->dq_count);\n                                      }\n                                      spin_unlock(&dq_list_lock);\n  spin_lock(&dq_list_lock);\n  dquot = list_first_entry(&rls_head);\n  WARN_ON_ONCE(atomic_read(&dquot->dq_count));\n\nThe problem is not only a cosmetic one as under memory pressure the\ncaller of dquot_scan_active() can end up working on freed dquot.\n\nFix the problem by making sure the dquot is removed from releasing list\nwhen we acquire a reference to it.\n\n## Affected\n\n- `linux_kernel >= 4.19.297, < 4.20`\n- `linux_kernel >= 5.4.259, < 5.5`\n- `linux_kernel >= 5.10.199, < 5.10.258`\n- `linux_kernel >= 5.15.136, < 5.15.209`\n- `linux_kernel >= 6.1.59, < 6.1.175`\n- `linux_kernel >= 6.5.8, < 6.6`\n- `linux_kernel >= 6.6.1, < 6.6.141`\n- `linux_kernel >= 6.7, < 6.12.91`\n- `linux_kernel >= 6.13, < 6.18.33`\n- `linux_kernel >= 6.19, < 7.0.10`\n- `linux_kernel = 6.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.10`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}