Junglewise Threat Intelligence

CVE-2026-90262: Linux kernel btrfs verity Merkle tree read handling defect

CVE-2026-90262 · Severity: info · CVSS 0 · Published 2026-09-17

Executive brief

A bug in the Linux kernel's btrfs filesystem can cause verification (verity) checks on file data to fail permanently when transient read errors occur. When a read operation temporarily fails, the kernel incorrectly treats subsequent attempts to read the same data as a permanent error rather than retrying, which could lead to legitimate files being rejected as corrupted.

Technical details

This is a logic defect in the btrfs_read_merkle_tree_page() function within the kernel's btrfs verity implementation (fs/btrfs/verity.c). The vulnerability occurs when reading Merkle tree pages used for fs-verity integrity checks. If a transient read failure leaves a folio (page) in a not-uptodate state in the page cache, subsequent callers find that folio and immediately return an error (-EIO) instead of retrying the read. The fix ensures that: (1) when a not-uptodate folio is found, the read is retried rather than immediately failing; (2) the folio is properly unlocked before returning errors so later callers can retry; (3) truncated folios are detected and the operation retries. The attack vector is local and requires no authentication, though this is primarily a reliability fix rather than a security vulnerability.

Affected products

  • Linux Linux kernel Multiple versions including 4.x, 5.x, 6.x, and 7.x series

Timeline

  • 2026-09-17: disclosed: CVE-2026-90262 published
  • 2026-09-14: patched: Fix committed upstream as commit 8cc569696dac51fc62bb39b3b8f530582b916d29 and backported to stable branches
  • 2026-07-22: other: Original fix authored by Yichong Chen

References

Related threats