Executive brief
The Linux kernel's Btrfs filesystem can crash with a NULL pointer dereference when mounting a corrupted filesystem using rescue options. This prevents system administrators from recovering data from damaged storage devices using rescue recovery procedures, forcing them to attempt recovery through other means.
Technical details
A NULL pointer dereference occurs in btrfs_update_global_block_rsv() when mounting with rescue=ibadroots option after filesystem corruption. The vulnerability is triggered when btrfs_read_roots() leaves root pointers NULL due to unreadable metadata, while their on-disk feature bits remain set. The function then attempts to dereference the NULL root pointer during global block reserve accounting. The fix checks if the filesystem is mounted in full read-only mode (which rescue mounts are) and skips the accounting operation, since rescue mounts cannot start transactions and never consume the global reserve.
Affected products
- Linux Linux kernel Linux 5.0 through at least 6.14
Timeline
- 2026-08-15: disclosed: Published in NVD
- 2026-07-13: patched: Upstream fix commit 51a0e8399858621442807a26057bcd1cd3ced046 authored
- 2026-08-09: patched: Backported to stable kernel tree