Skip to content
Heist/ feed
Unrated

btrfs: fix deadlock cloning inline extent when using flushoncommit

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock cloning inline extent when using flushoncommit In commit b48c980b6a7e ("btrfs: fix deadlock between reflink and transaction commit when using flushoncommit") a deadlock was fixed between reflinks and transaction commits when the fs is mounted with the flushoncommit option. This happened when we had to copy an inline extent's data to the destination file. However the issue was fixed only for the case where the destination offset is 0, it missed the case when the offset is greater than zero. Fix this by ensuring we get i_size update whenever we copied an inline extent's data into the destination file. Syzbot reported this with the following trace: INFO: task kworker/u8:3:57 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:3 state:D stack:21600 pid:57 tgid:57 ppid:2 task_flags:0x4208160 flags:0x00080000 Workqueue: writeback wb_workfn (flush-btrfs-129) Call Trace: context_switch kernel/sched/core.c:5402 [inline] __schedule+0x16f9/0x5500 kernel/sched/core.c:7204 __schedule_loop kernel/sched/core.c:7283 [inline] schedule+0x164/0x360 kernel/sched/core.c:7298 wait_extent_bit fs/btrfs/extent-io-tree.c:905 [inline] btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:2008 btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline] btrfs_invalidate_folio+0x440/0xc00 fs/btrfs/inode.c:7718 extent_w

Announced Source revision 1
Original source ↗

CVE-2026-74318

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-74318

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
        "lessThan": "50d1a47fb3c4f3ee6c581e6bc4f1fb8d7051c5d1",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
        "lessThan": "06283034cec0fa357cbd85784ef7d3f5b2ce0790",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
        "lessThan": "2aa37c8ef1092c6f088e23a90bffefc672831c09",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
        "lessThan": "ea3452726ccb6bcaa732f43cc57bb928eca3dd59",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
        "lessThan": "532085d00eb54c074bdeae648b194765239f4d11",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "fs/btrfs/reflink.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.7"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.7",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.97",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.40",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.1.5",
        "versionType": "semver",
        "lessThanOrEqual": "7.1.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "fs/btrfs/reflink.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-74318

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#46544 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement