Executive brief
The Linux kernel's btrfs filesystem contains a bug in delayed reference processing that can cause the kernel to crash when attempting to lock an improperly handled error pointer. Under certain conditions, error handling during filesystem extent tree operations can lead to invalid memory access, resulting in a system crash or denial of service on systems using btrfs.
Technical details
The vulnerability exists in the __btrfs_run_delayed_refs() function within fs/btrfs/extent-tree.c. When btrfs_select_ref_head() returns an error pointer (ERR_PTR(-EAGAIN)), the code attempts to continue the loop without resetting the 'locked_ref' variable to NULL. On the next loop iteration, the function tries to acquire a spin lock against this invalid error pointer via spin_lock(&locked_ref->lock), causing an invalid pointer dereference. The root cause is a regression from a prior refactoring (commit 0110a4c43451) that removed error state cleanup. The fix resets 'locked_ref' to NULL and uses a goto statement to properly handle the -EAGAIN error case, restoring the original error handling logic.
Affected products
- Linux Linux kernel Multiple versions (btrfs subsystem) including 5.x, 6.x, 7.x series
Timeline
- 2026-08-15: disclosed: CVE-2026-74321 published
- 2026-05-21: patched: Fix commit 486f8298b6188ff11ef1f4be7f1d5d2e4d1b1fae authored by Filipe Manana
- 2026-07-24: other: Patches merged into stable kernel trees