{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.94-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  quota: Fix race of dquot_scan_active() with quota deactivation  dquot_scan_active() can race with quota deactivation in quota_release_workfn() like:    CPU0 (quota_release_workfn)         CPU1 (dquot_scan_active)   ==============================      ==============================   spin_lock(\u0026dq_list_lock);   list_replace_init(     \u0026releasing_dquots, \u0026rls_head);     /* dquot X on rls_head,        dq_count == 0,        DQ_ACTIVE_B still set */   spin_unlock(\u0026dq_list_lock);   synchronize_srcu(\u0026dquot_srcu);                                       spin_lock(\u0026dq_list_lock);                                       list_for_each_entry(dquot,                                           \u0026inuse_list, dq_inuse) {                                         /* finds dquot X */                                         dquot_active(X) -\u003e true                                         atomic_inc(\u0026X-\u003edq_count);                                       }                                       spin_unlock(\u0026dq_list_lock);   spin_lock(\u0026dq_list_lock);   dquot = list_first_entry(\u0026rls_head);   WARN_ON_ONCE(atomic_read(\u0026dquot-\u003edq_count));  The problem is not only a cosmetic one as under memory pressure the caller of dquot_scan_active() can end up working on freed dquot.  Fix the problem by making sure the dquot is removed from releasing list when we acquire a reference to it.",
  "id": "DEBIAN-CVE-2026-53050",
  "modified": "2026-09-09T08:47:24.083760126Z",
  "published": "2026-06-24T17:17:16.887Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-53050"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-53050"
  ]
}