Executive brief
A flaw in the Linux kernel's Btrfs file system can cause a system deadlock, leading to a complete freeze or hang of file operations. This occurs when specific file cloning operations (reflink) conflict with background data saving processes (transaction commits) while using the 'flushoncommit' setting. An attacker or a malfunctioning application could trigger this state to cause a denial of service, impacting system availability and reliability.
Technical details
A deadlock exists in the Btrfs implementation within the Linux kernel when the 'flushoncommit' mount option is enabled. The issue arises during a reflink operation that copies an inline extent to a destination offset beyond the current i_size, creating a dirty folio. A concurrent transaction commit (Task B) triggers a delalloc flush which attempts to invalidate this folio; however, it blocks while trying to acquire an extent lock held by the reflink task (Task A). Simultaneously, Task A blocks while attempting to start a transaction to update the inode, waiting for Task B's transaction commit to finish. This circular dependency results in a permanent hang of both processes and potentially the entire file system. The vulnerability was identified via syzbot and has been resolved in various stable kernel branches.
Affected products
- Linux Linux kernel All versions using Btrfs with flushoncommit mount option
Timeline
- 2026-03-23: other: Patch authored
- 2026-05-23: patched: Patch committed to stable branches
- 2026-06-24: disclosed: CVE published