CVE-2026-97521

A flaw was found in the Linux kernel's GFS2 (Global File System 2) file system, which can lead to a Denial of Service (DoS). In real-time kernel configurations, the quota initialization routine improperly invokes a sleeping function while holding an atomic lock. A local user capable of triggering GFS2 quota operations could exploit this behavior to cause a kernel crash and system unresponsiveness.

A LOW impact denial of service flaw was found in the Linux kernel's GFS2 file system, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8 and 9, as well as the RHEL CoreOS 9 components used by OpenShift Container Platform 4. During GFS2 quota initialization, the duplicate quota_change ID scan uses gfs2_qd_search_bucket(), which acquires a lockref reference via lockref_get_not_dead() while the quota hash bucket bitlock is held. On real-time (PREEMPT_RT) kernels this operation may sleep in an atomic context, triggering a "sleeping function called from invalid context" error that can crash the kernel. A local user able to trigger GFS2 quota operations could use this flaw to cause a denial of service (kernel crash and system unresponsiveness). Red Hat Product Security rated this flaw LOW impact because it only manifests on real-time (PREEMPT_RT) kernel configurations, requires local access with the ability to trigger GFS2 quota operations, and is limited to availability impact with no confidentiality or integrity impact. Several Red Hat Enterprise Linux 8 and 9 update streams (rhel-8.4.0.z, rhel-8.6.0.z, rhel-8.8.0.z, rhel-9.2.0.z, rhel-9.4.z), Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS, and OpenShift Container Platform 4.12 through 4.18 are not affected because the vulnerable code is not present in those kernels. The fix is currently deferred for the affected streams due to the low impact; the residual risk is limited to a local denial of service on systems running real-time kernels that perform GFS2 quota operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.