Executive brief
A bug in the Linux kernel's btrfs filesystem can cause verification (verity) checks on file data to fail permanently when transient read errors occur. When a read operation temporarily fails, the kernel incorrectly treats subsequent attempts to read the same data as a permanent error rather than retrying, which could lead to legitimate files being rejected as corrupted.
Technical details
This is a logic defect in the btrfs_read_merkle_tree_page() function within the kernel's btrfs verity implementation (fs/btrfs/verity.c). The vulnerability occurs when reading Merkle tree pages used for fs-verity integrity checks. If a transient read failure leaves a folio (page) in a not-uptodate state in the page cache, subsequent callers find that folio and immediately return an error (-EIO) instead of retrying the read. The fix ensures that: (1) when a not-uptodate folio is found, the read is retried rather than immediately failing; (2) the folio is properly unlocked before returning errors so later callers can retry; (3) truncated folios are detected and the operation retries. The attack vector is local and requires no authentication, though this is primarily a reliability fix rather than a security vulnerability.
Affected products
- Linux Linux kernel Multiple versions including 4.x, 5.x, 6.x, and 7.x series
Timeline
- 2026-09-17: disclosed: CVE-2026-90262 published
- 2026-09-14: patched: Fix committed upstream as commit 8cc569696dac51fc62bb39b3b8f530582b916d29 and backported to stable branches
- 2026-07-22: other: Original fix authored by Yichong Chen