---
id: CVE-2026-53050
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  quota: Fix race of dquot_scan_active() with quota deactivation

  dquot_scan_active() can race with quota deactivation in
  quota_release_workfn() like:

    CPU0 (quota_rele…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  quota: Fix race of dquot_scan_active() with quota deactivation

  dquot_scan_active() can race with quota deactivation in
  quota_release_workfn() like:

    CPU0 (quota_rele…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-362
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.19.297, < 4.20'
  - 'linux_kernel >= 5.4.259, < 5.5'
  - 'linux_kernel >= 5.10.199, < 5.10.258'
  - 'linux_kernel >= 5.15.136, < 5.15.209'
  - 'linux_kernel >= 6.1.59, < 6.1.175'
  - 'linux_kernel >= 6.5.8, < 6.6'
  - 'linux_kernel >= 6.6.1, < 6.6.141'
  - 'linux_kernel >= 6.7, < 6.12.91'
  - 'linux_kernel >= 6.13, < 6.18.33'
  - 'linux_kernel >= 6.19, < 7.0.10'
  - linux_kernel = 6.6
patched:
  - linux_kernel 7.0.10
published: '2026-06-24'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T09:18:14.037'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53050'
references:
  - url: 'https://git.kernel.org/stable/c/2bdc80f4619411e5bd4a3ef23f51e14021ed457c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/61e25f664dc2a08299e07d84c85776abc2350f75'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6678dde265708003c2b42551af4a2e3cb05decd5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/82cbdb4c1ebb5ea7d7bd45c18d3483b5bd32ebc1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ac8a2e0d287ebf35e5d7e51e260b4e146648ba4a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f9438cb8c8ec3adc84b2b450a3aab0123d074c3b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fdd424d7c35633ac577fd87d1b043d1b8a6cd350'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00138
epssPercentile: 0.02618
ingestedAt: '2026-09-08T13:33:25.473Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

quota: Fix race of dquot_scan_active() with quota deactivation

dquot_scan_active() can race with quota deactivation in
quota_release_workfn() like:

  CPU0 (quota_release_workfn)         CPU1 (dquot_scan_active)
  ==============================      ==============================
  spin_lock(&dq_list_lock);
  list_replace_init(
    &releasing_dquots, &rls_head);
    /* dquot X on rls_head,
       dq_count == 0,
       DQ_ACTIVE_B still set */
  spin_unlock(&dq_list_lock);
  synchronize_srcu(&dquot_srcu);
                                      spin_lock(&dq_list_lock);
                                      list_for_each_entry(dquot,
                                          &inuse_list, dq_inuse) {
                                        /* finds dquot X */
                                        dquot_active(X) -> true
                                        atomic_inc(&X->dq_count);
                                      }
                                      spin_unlock(&dq_list_lock);
  spin_lock(&dq_list_lock);
  dquot = list_first_entry(&rls_head);
  WARN_ON_ONCE(atomic_read(&dquot->dq_count));

The problem is not only a cosmetic one as under memory pressure the
caller of dquot_scan_active() can end up working on freed dquot.

Fix the problem by making sure the dquot is removed from releasing list
when we acquire a reference to it.

## Affected

- `linux_kernel >= 4.19.297, < 4.20`
- `linux_kernel >= 5.4.259, < 5.5`
- `linux_kernel >= 5.10.199, < 5.10.258`
- `linux_kernel >= 5.15.136, < 5.15.209`
- `linux_kernel >= 6.1.59, < 6.1.175`
- `linux_kernel >= 6.5.8, < 6.6`
- `linux_kernel >= 6.6.1, < 6.6.141`
- `linux_kernel >= 6.7, < 6.12.91`
- `linux_kernel >= 6.13, < 6.18.33`
- `linux_kernel >= 6.19, < 7.0.10`
- `linux_kernel = 6.6`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.10`