Executive brief
A vulnerability in the Linux kernel's btrfs filesystem can cause data corruption when file contents are modified via memory-mapped access while the filesystem is simultaneously writing those files to disk. The issue stems from missing write-protection during the data writeback process, which can result in lost writes, corrupted checksums, or silent data corruption that goes undetected until later when the file is read back.
Technical details
The vulnerability involves a missing folio_clear_dirty_for_io() call in extent_write_cache_pages() after commit 095be159f3eb replaced it with a plain folio_test_dirty() check. folio_clear_dirty_for_io() not only clears the dirty flag but also calls folio_mkclean(), which write-protects shared mmap PTEs. Without this early protection, a process with an mmap-ed view of the file can modify sectors while writeback operations (checksumming, compressing, copying) are in progress, expecting stable folios. This manifests in multiple scenarios: partial bio submissions causing checksum violations or lost writes, zoned writes spanning folios risking csum violations, inline extent writes potentially losing data, and compressed extents being modified during compression work. The fix requires restoring the write-protection call in extent_write_cache_pages() and related codepaths.
Affected products
- Linux Linux kernel various versions with btrfs filesystem after commit 095be159f3eb
Timeline
- 2026-09-11: disclosed