Executive brief
A vulnerability in the Linux kernel's Btrfs file system could lead to a system crash (NULL pointer dereference) during certain error conditions. This occurs when the system fails to properly clean up internal data structures after a failed write operation, potentially affecting system stability and availability. An attacker with local access could potentially trigger this state to cause a denial-of-service.
Technical details
A vulnerability exists in the Btrfs component of the Linux kernel within the btrfs_write_and_wait_transaction() function. The root cause is the unconditional calling of btrfs_extent_io_tree_release(), even when btrfs_write_marked_extent() returns an error. This clears the dirty_pages IO tree while it still contains unsubmitted dirty records. During subsequent transaction cleanup or filesystem unmount (specifically at iput() time for the btree inode), the system may attempt writebacks using worker threads that have already been stopped, resulting in a NULL pointer dereference. The fix ensures the IO tree is only released upon successful write completion, allowing the transaction cleanup path to handle dirty buffers correctly.
Affected products
- Linux Linux Kernel 6.1+
Timeline
- 2026-04-30: other: Patch authored
- 2026-06-26: disclosed: CVE published