Executive brief
The Linux kernel's btrfs filesystem has a deadlock vulnerability in its zoned storage support that can cause the system to hang. When the filesystem attempts to write metadata to zoned storage devices, two internal tasks can become stuck waiting for each other, causing service interruption and potential data unavailability until the system is restarted.
Technical details
The vulnerability is a deadlock in the btrfs zoned metadata writeback path. The btree_writepages() function holds the fs_info->zoned_meta_io_lock while calling btrfs_check_meta_write_pointer(). For tree-log block groups, check_bg_is_active() may invoke btrfs_zone_finish_one_bg() to free an active zone, which calls btrfs_wait_for_commit() while still holding zoned_meta_io_lock. Meanwhile, the transaction committer needs that same lock to write tree extents, creating a classic deadlock. The fix releases the zoned_meta_io_lock around the btrfs_zone_finish_one_bg() call in the tree-log branch and re-acquires it afterwards, mirroring an existing pattern in a sibling code path. The lock only protects fs_info->active_{meta,system}_bg, which the tree-log branch does not modify.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-08-15: disclosed