Executive brief
A bug in Linux kernel's btrfs zoned filesystem mode can cause the filesystem to become read-only during metadata-heavy operations like file relocation. The issue occurs when the kernel cannot properly write metadata to disk due to a lock contention scenario, forcing an emergency shutdown of write operations to prevent system deadlock.
Technical details
This vulnerability is a logic flaw in the btrfs zoned filesystem metadata writeback path (btree_writepages()). On zoned storage, only one metadata block group can be active for writing at a time. When the kernel walks metadata in ascending logical order but encounters a lower-addressed block group with dirty data while a higher-addressed block group is still active with pending IO, it cannot pivot to the lower block group due to a deliberate lock-avoidance constraint during commit (WB_SYNC_ALL && !for_sync). This causes btrfs_check_meta_write_pointer() to return -EAGAIN, which is treated as fatal and aborts the transaction, forcing the filesystem read-only. The fix flushes active metadata and system block groups at btree_writepages() start to eliminate unsent IO and enable the pivot operation to succeed. The issue manifests intermittently under metadata-heavy workloads like btrfs/187 fstests relocation scenarios.
Affected products
- Linux Linux kernel affected versions unspecified
Timeline
- 2026-09-17: disclosed