CVE-2026-53050

A flaw was found in the Linux kernel. A race condition exists between the dquot_scan_active() function and quota deactivation within quota_release_workfn(). This vulnerability could allow a local attacker to cause memory corruption by manipulating quota operations, potentially leading to system instability or a denial of service (DoS).

A race in quota dquot handling can occur when dquot_scan_active runs concurrently with quota deactivation in quota_release_workfn. A dquot with dq_count 0 can still have DQ_ACTIVE_B set and can be found by the active scan, which may take a reference without removing it from the releasing list. Under memory pressure this can let the scan path operate on a freed dquot, creating a use after free condition. For the CVSS the PR:L is used for the paranoid score because a local user can influence quota objects and memory pressure while quota deactivation or filesystem management is occurring, although reliable standalone triggering may require privileged quota management. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to use after free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.