CVE-2026-43127 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix circular locking dependency in run_unpack_ex Syzbot reported a circular locking dependency between wnd->rw_lock (sbi->used.bitmap) and ni->file.run_lock. The deadlock scenario: 1. ntfs_extend_mft() takes ni->file.run_lock then wnd->rw_lock. 2. run_unpack_ex() takes wnd->rw_lock then tries to acquire ni->file.run_lock inside ntfs_refresh_zone(). This creates an AB-BA deadlock. Fix this by using down_read_trylock() instead of down_read() when acquiring run_lock in run_unpack_ex(). If the lock is contended, skip ntfs_refresh_zone() - the MFT zone will be refreshed on the next MFT operation. This breaks the circular dependency since we never block waiting for run_lock while holding wnd->rw_lock.
A circular locking dependency vulnerability has been identified in the Linux kernel's NTFS3 file system module, specifically within the 'run_unpack_ex' function. This vulnerability creates a deadlock scenario by causing a circular wait between two locks: 'ni->file.run_lock' and 'wnd->rw_lock' (associated with 'sbi->used.bitmap'). The deadlock occurs when 'ntfs_extend_mft' acquires 'ni->file.run_lock' before 'wnd->rw_lock', while 'run_unpack_ex' takes 'wnd->rw_lock' and then attempts to acquire 'ni->file.run_lock' again through 'ntfs_refresh_zone', leading to an AB-BA deadlock situation.
The vulnerability has been fixed by modifying 'run_unpack_ex' to use 'down_read_trylock' instead of 'down_read' when acquiring 'run_lock'. This change allows the function to skip 'ntfs_refresh_zone' if the lock is contested, preventing the deadlock. The fix is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/08ce2fee1b869ecbfbd94e0eb2630e52203a2e03 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b014372b62237521444ee51384549bdf48b79015 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b8d22d9d8260b0f4f4d8e2898c98037c9982ea66 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-667 | Improper Locking | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.6.66, < 6.18.16 >= 6.19, < 6.19.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 6, 2026 | New CVE Received | kernel.org |