CVE-2026-99132

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't hold buffer locks across sync transaction commit in xfs sync sb buf

xfs sync sb buf() holds sb/rtsb buffer locks across a synchronous xfs trans commit(), which flushes the CIL push workqueue internally. If shutdown occurs during the CIL push, xfs buf item unpin() needs to lock these buffers to fail them, causing a deadlock:

setlabel: holds buf lock -> flush workqueue(xfs-cil) CIL push worker: xfs buf item unpin -> xfs buf lock(same buf)

Remove the xfs trans bhold() calls so that commit releases the buffer locks normally. After the sync commit, re-acquire the buffers via mp->m sb bp / mp->m rtsb bp for the on-disk writeback.