Linux Kernel CVE-2026-46061

jbd2 (Journal Block Device 2) is the journaling layer underpinning ext4 and other Linux filesystems, managing transaction metadata to ensure consistency. The vulnerability was introduced by commit f76d4c28a46a, which changed jbd2_journal_cancel_revoke() to call __find_get_block_nonatomic() - a function that acquires the folio (page) lock rather than i_private_lock. CWE-667 (Improper Locking) is the root cause: on filesystems where blocksize is less than the system pagesize, two kernel threads can acquire the folio lock and buffer lock in opposite orders. Thread T1 (ext4_mkdir → lock_buffer → jbd2_journal_cancel_revoke → folio_lock) and Thread T2 (sync_blockdev → writeback path → folio_lock → lock_buffer) each hold one lock while waiting for the other, producing a classic ABBA deadlock. Affected CPEs span cpe:2.3:o:linux:linux_kernel across multiple stable series including 6.12.x prior to 6.12.86 and 6.15 through rc7. The Tags field in the source data labels this 'Information Disclosure,' which conflicts with the CVSS vector (C:N) and the description - this appears to be a mislabeled tag; there is no confidentiality impact.