CVE-2026-97902

A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) by initiating nested filesystem freeze and thaw operations. An incorrect error code returned during nested thaw requests causes the kernel to retain an elevated freeze counter on the underlying block device. Consequently, the device remains permanently locked in a frozen state after being unmounted, preventing subsequent mount operations until the device is re-created or the system is rebooted.

A low impact denial of service flaw was found in the Linux kernel's filesystem freeze/thaw handling in fs/super.c. When a mounted filesystem is frozen via FIFREEZE and additionally frozen through a block-device-level freeze, which nests by design in paths such as device-mapper suspend/resume or an LVM snapshot of the origin volume, thaw_super_locked() drops the nested freeze reference but incorrectly returns -EINVAL even though the thaw succeeded. As a result, bdev_thaw() keeps the block device freeze counter (bd_fsfreeze_count) permanently elevated, and after the user thaws the filesystem and unmounts it, the underlying block device remains marked as frozen and can never be mounted again until the block device is destroyed or the system is rebooted; there is no way for userspace to drop the leaked count. Exploiting this requires local access with the privileges needed to issue filesystem freeze ioctls and device-mapper management operations (CAP_SYS_ADMIN), and only the availability of the affected block device is impacted, with no confidentiality or integrity impact. For this reason Red Hat rates the impact of this flaw as low, although the Red Hat CVSS 3.1 base score is 5.5 (Moderate).

Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected by this flaw, and the fix is currently deferred on those streams because of the low impact and the privileged local access required to trigger it; the residual risk is that a local privileged user could render a block device unmountable until the system is rebooted. Red Hat Enterprise Linux 6, 7, 8, and 9 (including the kernel-rt variants) and the RHEL CoreOS 8 and RHEL CoreOS 9 containers shipped with OpenShift Container Platform are not affected because the vulnerable code is not present in those versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.