Executive brief
The Linux kernel's btrfs filesystem has a race condition that can occur when direct I/O writes fail and are retried as buffered writes. The kernel can attempt to create overlapping ordered extent entries, causing a kernel panic and system crash. This affects systems using btrfs for storage and performing mixed direct and buffered write operations.
Technical details
The vulnerability is a race condition in btrfs ordered extent handling triggered by a logic error introduced in commit ff66fe666233. When a direct I/O write fails partway through, the kernel reverts the file's reported size (isize) to allow append writes to be respected during buffered fallback. However, the lock_and_cleanup_extent_if_need() function only waits for existing ordered extents if the write position is within the current isize, causing it to skip waiting for the reverted case. This allows the old direct I/O ordered extent to still exist in the tree when a new buffered write ordered extent is inserted for the same range, triggering a kernel panic in insert_ordered_extent(). The fix makes ordered extent waiting unconditional regardless of isize position. Attack requires local access and ability to trigger mixed direct/buffered I/O patterns on btrfs filesystems.
Affected products
- Linux Linux kernel Affected versions include commit ff66fe666233 and later before the fix
Timeline
- 2026-09-17: disclosed