Executive brief
The Btrfs filesystem component in the Linux kernel could corrupt extent tree metadata on zoned storage devices. When the kernel writes freed tree blocks as zeros to maintain zone write pointers, a race condition allowed the in-memory copy to be cleared while it was still being referenced by other kernel code, leading to corrupted extent tree pointers and filesystem data loss.
Technical details
The vulnerability is a use-after-clear race condition in Btrfs's zoned filesystem support. The btree_csum_one_bio() function zeroed extent buffer folios in-memory via memzero_extent_buffer() before I/O submission, but btrfs_free_tree_block() could execute afterward and read the now-zeroed header to add a delayed reference, causing it to write address 0 to the extent tree and triggering assertions or reference lookup failures. The fix changes the implementation to write zeros to disk from a shared zero page instead, leaving the in-memory buffer intact for later references. The vulnerability affects zoned Btrfs filesystems on all kernel versions since the introduction of EXTENT_BUFFER_ZONED_ZEROOUT support, with exploitation reproducible via fsstress tests.
Affected products
- Linux Linux kernel All versions with Btrfs zoned support (since introduction of aa6313e6ff2b)
Timeline
- 2026-09-17: disclosed: CVE-2026-90260 published
- 2026-09-14: patched: Fix committed to Linux stable by Sasha Levin