Skip to main content

Linux Kernel btrfs EUVDEUVD-2026-38990

| CVE-2026-53122 MEDIUM
Improper Locking (CWE-667)
2026-06-24 Linux GHSA-qcjh-44gv-7799
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Local user triggers reflink copying inline extent beyond destination EOF
  2. Delivery
    Reflink task acquires extent io tree lock on destination inode range
  3. Exploit
    Concurrent transaction commit invokes btrfs_start_delalloc_flush()
  4. Install
    Writeback worker enters btrfs_invalidate_folio() and blocks on held extent lock
  5. C2
    Reflink task attempts to open new transaction but blocks on TRANS_STATE_COMMIT_START
  6. Execute
    Circular wait achieved - both tasks in uninterruptible sleep
  7. Impact
    Kernel hung task / effective DoS

Vulnerability Assessment

Weakness
CWE
CWE-667
ASVS 5.0
V15 - Secure Coding and Architecture Proper locking
Exploitation Conditions

The btrfs filesystem must be mounted with the flushoncommit mount option explicitly enabled - this is non-default and must be set by the storage administrator. A reflink (clone) operation must copy a btrfs inline extent to a destination file at an offset strictly greater than the destination file's current i_size, creating a dirty folio beyond EOF. Concurrent execution of a transaction commit (triggered by background writeback or sync pressure) and the reflink task is required to create the race. Exploitation requires a local user account with write access to files on the affected btrfs volume (PR:L). Systems not using btrfs, or using btrfs without flushoncommit, are entirely unaffected. The race window exists only during the brief interval when the extent io tree lock is held by the reflink task and a transaction commit is simultaneously in progress.
Impact

The vendor-assigned CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is broadly accurate: local low-privilege access is required, and impact is limited to availability (kernel task hang). EPSS at 0.18% (8th percentile) strongly indicates this is not an actively targeted vulnerability. It is absent from CISA KEV and no POC has been identified. The 'Information Disclosure' tag in the source intelligence appears erroneous - the CVSS vector (C:N/I:N/A:H) and the technical description confirm a pure availability impact with no data exposure. Real-world risk is further constrained by two non-default prerequisites: btrfs must be the active filesystem (versus ext4, xfs, or others), and the flushoncommit mount option must be explicitly set. On systems meeting both conditions and running concurrent reflink workloads, the impact is a genuine hard hang of kernel worker threads that may require a reboot to resolve. This is a meaningful operational risk for NAS appliances, storage servers, or CI/CD build farms using btrfs with flushoncommit, but not a broadly prioritized CVE for general Linux fleets.
Exploit ScenarioDerived

A local user with write access to a btrfs filesystem mounted with flushoncommit deliberately (or inadvertently) invokes a reflink (copy_file_range) cloning an inline extent from a source file to a byte offset in a destination file that lies beyond the destination's current i_size, while a background writeback worker is concurrently executing a btrfs transaction commit. The two kernel execution paths enter a circular wait on each other's locks, causing both the worker thread and the reflink task to enter uninterruptible sleep indefinitely. No public exploit code exists; this scenario can arise naturally in high-throughput btrfs storage workloads.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

Deadlock in the Linux kernel btrfs filesystem subsystem triggers an unrecoverable kernel hang when the flushoncommit mount option is active and a reflink operation copies an inline extent to a destination offset beyond the target inode's i_size. The circular wait arises because the reflink task holds the extent io tree lock while blocking on a pending transaction commit, while the commit's delalloc flush simultaneously blocks trying to acquire that same held lock. No public exploit or CISA KEV listing exists; EPSS is 0.18% (8th percentile), reflecting very low real-world exploitation interest.

RemediationAI

Update to a patched Linux kernel: 6.12.91, 7.0.10, 6.18.33, or 7.1, available via kernel.org stable branches and the git commits referenced above. Ubuntu users should apply USN-8568-1, USN-8567-1, or USN-8566-1 via standard package updates. As an immediate workaround where patching is not yet feasible, remove the flushoncommit option from btrfs mount arguments (edit /etc/fstab or the relevant systemd mount unit and remount). Trade-off: removing flushoncommit reduces write durability guarantees, increasing the data-loss window on unexpected power loss since dirty pages will be written on a background schedule rather than synchronously at each transaction commit. A second workaround is to avoid performing reflink (copy_file_range or ioctl BTRFS_IOC_CLONE) operations targeting inline extents at non-zero destination offsets while heavy transaction commit load is present, but this is operationally difficult to enforce. Patch application is the definitive fix.

Affected VersionsENISA

Linux 05a5a7621ce66c142e081ffc24dd6ade6e912061 <b48c980b6a7e409050bb3067165db31cc6205e3e
Linux patch: 6.12.91
Linux 05a5a7621ce66c142e081ffc24dd6ade6e912061 <6f0f9c0a368aa1fe078109091322d3b0632d9380
Linux patch: 7.0.10
Linux 05a5a7621ce66c142e081ffc24dd6ade6e912061 <9a24f0000876b8755cf21972b41632f4d6f3dafb
Linux 05a5a7621ce66c142e081ffc24dd6ade6e912061 <73be4a08306bb84f4d5d16f62cb80e1543109ffa
Linux patch: 6.18.33
Linux patch: 0
Linux patch: 7.1
Linux 5.7

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerable code path lives in the btrfs subsystem (fs/btrfs/) of the Linux kernel, specifically in the interaction between copy_inline_to_page() used during reflink (clone) operations and btrfs_start_delalloc_flush() invoked during transaction commits. CWE-667 (Improper Locking) identifies the root cause: a circular lock dependency where two kernel tasks form a classic AB-BA deadlock. Task A (reflink) holds the extent io tree lock for the destination inode's range and then attempts to open a new transaction, which blocks because a commit is in progress. Task B (transaction commit kworker, visible in the syzbot trace as kworker/u8:7 in wb_workfn) holds the transaction state lock and then enters btrfs_invalidate_folio() → btrfs_lock_extent(), which blocks on the lock held by Task A. The flushoncommit mount option is the enabling condition: it causes btrfs to synchronously flush all dirty delalloc pages during every transaction commit, introducing the race window. CPE cpe:2.3:a:linux:linux covers affected versions from the introducing commit 05a5a7621ce66c142e081ffc24dd6ade6e912061 (post-5.7) through the patched stable releases.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.7 MEDIUM

Race condition requires concurrent reflink and transaction commit, warranting AC:H; local PR:L filesystem access required; no confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 23, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix deadlock between reflink and transaction commit when using flushoncommit

When using the flushoncommit mount option, we can have a deadlock between a transaction commit and a reflink operation that copied an inline extent to an offset beyond the current i_size of the destination node.

The deadlock happens like this:

  1. Task A clones an inline extent from inode X to an offset of inode Y

that is beyond Y's current i_size. This means we copied the inline extent's data to a folio of inode Y that is beyond its EOF, using a call to copy_inline_to_page();

  1. Task B starts a transaction commit and calls

btrfs_start_delalloc_flush() to flush delalloc;

  1. The delalloc flushing sees the new dirty folio of inode Y and when it

attempts to flush it, it ends up at extent_writepage() and sees that the offset of the folio is beyond the i_size of inode Y, so it attempts to invalidate the folio by calling folio_invalidate(), which ends up at btrfs' folio invalidate callback - btrfs_invalidate_folio(). There it tries to lock the folio's range in inode Y's extent io tree, but it blocks since it's currently locked by task A - during a reflink we lock the inodes and the source and destination ranges after flushing all delalloc and waiting for ordered extent completion - after that we don't expect to have dirty folios in the ranges, the exception is if we have to copy an inline extent's data (because the destination offset is not zero);

  1. Task A then attempts to start a transaction to update the inode item,

and then it's blocked since the current transaction is in the TRANS_STATE_COMMIT_START state. Therefore task A has to wait for the current transaction to become unblocked (its state >= TRANS_STATE_UNBLOCKED).

So task A is waiting for the transaction commit done by task B, and the later waiting on the extent lock of inode Y that is currently held by task A.

Syzbot recently reported this with the following stack traces:

INFO: task kworker/u8:7:1053 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:7 state:D stack:23520 pid:1053 tgid:1053 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: writeback wb_workfn (flush-btrfs-46) Call Trace: <TASK> context_switch kernel/sched/core.c:5298 [inline] __schedule+0x1553/0x5240 kernel/sched/core.c:6911 __schedule_loop kernel/sched/core.c:6993 [inline] schedule+0x164/0x360 kernel/sched/core.c:7008 wait_extent_bit fs/btrfs/extent-io-tree.c:811 [inline] btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:1914 btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline] btrfs_invalidate_folio+0x43d/0xc40 fs/btrfs/inode.c:7704 extent_writepage fs/btrfs/extent_io.c:1852 [inline] extent_write_cache_pages fs/btrfs/extent_io.c:2580 [inline] btrfs_writepages+0x12ff/0x2440 fs/btrfs/extent_io.c:2713 do_writepages+0x32e/0x550 mm/page-writeback.c:2554 __writeback_single_inode+0x133/0x11a0 fs/fs-writeback.c:1750 writeback_sb_inodes+0x995/0x19d0 fs/fs-writeback.c:2042 wb_writeback+0x456/0xb70 fs/fs-writeback.c:2227 wb_do_writeback fs/fs-writeback.c:2374 [inline] wb_workfn+0x41a/0xf60 fs/fs-writeback.c:2414 process_one_work kernel/workqueue.c:3276 [inline] process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> INFO: task syz.4.64:6910 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.64 state:D stack:22752 pid:6910 tgid: ---truncated---

Threat Intelligence Overview

EPSS Score
0.2%
Top 92% exploitable
Prevalence
High
Linux kernel widely deployed; btrfs with flushoncommit is non-default subset
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-667 – Improper Locking

View all
CVE-2019-10072 HIGH
7.5
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-GCE Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53122 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373361 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22511/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22512/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22521/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22522/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22665/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22666/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22699/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22812/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22835/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2799/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2800/ REF https://git.kernel.org/stable/c/1034251715a3474d8615232a032ed0e3451ae6ec REF https://git.kernel.org/stable/c/5446d3e7676d73737f8dca816a956ede8ac24921 REF https://git.kernel.org/stable/c/6f0f9c0a368aa1fe078109091322d3b0632d9380 REF https://git.kernel.org/stable/c/73be4a08306bb84f4d5d16f62cb80e1543109ffa REF https://git.kernel.org/stable/c/9a24f0000876b8755cf21972b41632f4d6f3dafb REF https://git.kernel.org/stable/c/b48c980b6a7e409050bb3067165db31cc6205e3e

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy