Executive brief
A vulnerability in the Linux kernel's Btrfs file system can cause a complete system hang. This occurs when the system's memory management and the file system enter a deadlock state while trying to manage data being written to the disk, particularly in environments with restricted memory limits like containers (cgroups). An exploit of this flaw results in a denial of service, requiring a system reboot and potentially causing operational downtime.
Technical details
A deadlock exists in the Btrfs file system between the btree inode writeback process and the cgroup dirty page throttling mechanism. Btrfs historically used an internal 32MiB threshold before triggering metadata writeback via btree_writepages(). In environments where a cgroup has a memory limit lower than this threshold (e.g., 16MiB), the memory management subsystem will throttle processes once the limit is reached, waiting for writeback to free memory. However, Btrfs will not initiate writeback because its internal threshold has not been met, resulting in a circular dependency and system hang. The fix involves removing the strict internal threshold in btree_writepages() to respect external writeback requests. This affects kernels prior to v6.18.
Affected products
- Linux Linux Kernel from 2.6.29 up to 6.18.9
Timeline
- 2026-02-14: advisory: CVE published
- 2026-03-25: patched: Fixes merged into various stable branches
References
- https://git.kernel.org/stable/c/0c3666ec188640c20e254011e7adf4464c32ee58
- https://git.kernel.org/stable/c/4357e02cafabe01c2d737ceb4c4c6382fc2ee10a
- https://git.kernel.org/stable/c/4e159150a9a56d66d247f4b5510bed46fe58aa1c
- https://git.kernel.org/stable/c/629666d20c7dcd740e193ec0631fdff035b1f7d6
- https://git.kernel.org/stable/c/6a8b6242eaa1dd7a0de2d6de6420d10ffe68db90
- https://git.kernel.org/stable/c/bb9be3f713652e330df00f3724c18c7a5469e7ac