btrfs: always wait for ordered extents to avoid OE races
In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races [BUG] Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical (device loop4): panic in insert_ordered_extent:264: overlapping ordered extents, existing oe file_offset 16384 num_bytes 430080 flags 0x1089, new oe file_offset 16384 num_bytes 430080 flags 0x80 (errno=-17 Object alrea[ 179.162726][ T6897] BTRFS critical (device loop4): panic in insert_ordered_extent:264: overlapping ordered extents, existing oe file_offset 16384 num_bytes 430080 flags 0x1089, new oe file_offset 16384 num_bytes 430080 flags 0x80 (errno=-17 Object already exists) ------------[ cut here ]------------ kernel BUG at fs/btrfs/ordered-data.c:264! Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:btrfs_alloc_ordered_extent+0x943/0xad0 Call Trace: cow_file_range+0x744/0x12a0 fallback_to_cow+0x5ea/0xa00 run_delalloc_nocow+0x110c/0x17a0 btrfs_run_delalloc_range+0xbe4/0x1c20 writepage_delalloc+0x104d/0x1ba0 btrfs_writepages+0x1667/0x28b0 do_writepages+0x338/0x560 filemap_fdatawrite_range+0x1f2/0x300 btrfs_fdatawrite_range+0x54/0xf0 btrfs_direct_write+0x6a0/0xc30 btrfs_do_write_iter+0x329/0x790 do_iter_readv_writev+0x624/0x8d0 vfs_writev+0x34c/0x990 __se_sys_pwritev2+0x17a/0x2a0 do_syscall_64+0x174/0x580 entry_SYSCALL_64_after_hwframe+0x77/0x7f ---[ end trace 0000000000000000 ]--- [CAUSE] Since commit ff
CVE-2026-90264
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-90264
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "097b159d43407b4ea0e5d14ae58a3bbfa5865a24",
"lessThan": "043b6fd9706e4335851f317352d2717ad40e6d83",
"versionType": "git"
},
{
"status": "affected",
"version": "ccd5c23122b01de646c80485e2fadac82d1aab62",
"lessThan": "de8f5cb3cb611f96909797b4b017831f5141cbbe",
"versionType": "git"
},
{
"status": "affected",
"version": "c3a3d3986719026c85950bfa6f41a251fc46e16f",
"lessThan": "58ce50b1802a446d3b26df1b9c58be1ab8913d0e",
"versionType": "git"
},
{
"status": "affected",
"version": "ff66fe6662330226b3f486014c375538d91c44aa",
"lessThan": "aaac9b352f7f53f5d2f7e58e612d67d2a2bf7094",
"versionType": "git"
},
{
"status": "affected",
"version": "ff66fe6662330226b3f486014c375538d91c44aa",
"lessThan": "ec78575dde998c21be7e0cb2503b5620f34b6255",
"versionType": "git"
},
{
"status": "affected",
"version": "4b5875cbb85dbf4d11385eb0a7a589c086d76d42",
"versionType": "git"
},
{
"status": "affected",
"version": "10b1abc1d0c8ae25c2b9ac465515717c68ffff05",
"versionType": "git"
},
{
"status": "affected",
"version": "b8df7f486a4617d3096b8fa27148cfa54b1d6a8d",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.145",
"lessThan": "6.6.160",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.97",
"lessThan": "6.12.114",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.40",
"lessThan": "6.18.52",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.212",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.178",
"lessThan": "6.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.1.4",
"lessThan": "7.2",
"versionType": "semver"
}
],
"programFiles": [
"fs/btrfs/file.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/btrfs/file.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-90264
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #48649 · Revision 1
- Added to Heist Feed
- Publisher date