CVE-2026-74571
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts [BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000100 RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs] Call Trace: fill_dummy_bgs+0xd4/0x120 [btrfs] open_ctree+0xc6e/0x1ca0 [btrfs] btrfs_get_tree+0x50d/0xa40 [btrfs] The same crash occurs with a corrupted raid stripe tree root, via btrfs_read_block_groups() instead of fill_dummy_bgs(). [CAUSE] With rescue=ibadroots, btrfs_read_roots() allows the mount to continue when either root cannot be read, leaving the corresponding root pointer NULL while its on-disk feature bit remains set. btrfs_update_global_block_rsv() then dereferences the missing root based on the feature bit alone. [FIX] Rescue mounts are fully read-only and cannot start transactions, so the global reserve is never consumed. Under btrfs_is_full_ro(), mark the reserve as full and return before performing the accounting. And since we need to check if the fs is mount fully RO, export fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h. [ Squash the fs_is_full_ro() export commit into this one. ]
How to fix
- Linux Linuxaa72cc4675240ab6b01ec72ac6a1fe832e715569, ca05d9abde2195cec3d07d0d4d65152d8171078f, 3a69fae2371a5ee190d4c4bbe5304a753558c1c6, 969a96479add6bd42d7f7241f99f27b31571a953, 076349e4c8d11f6b58c4549976a513b2b4dc6df2, 51a0e8399858621442807a26057bcd1cd3ced046, 6.1.191, 6.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | cbec34d3021d47007a0334c634f7053dbaf93d02 ≤ v < aa72cc4675240ab6b01ec72ac6a1fe832e715569, 8dbfc14fc736eb701089aff09645c3d4ad3decb1 ≤ v < ca05d9abde2195cec3d07d0d4d65152d8171078f, 8dbfc14fc736eb701089aff09645c3d4ad3decb1 ≤ v < 3a69fae2371a5ee190d4c4bbe5304a753558c1c6, 8dbfc14fc736eb701089aff09645c3d4ad3decb1 ≤ v < 969a96479add6bd42d7f7241f99f27b31571a953, 8dbfc14fc736eb701089aff09645c3d4ad3decb1 ≤ v < 076349e4c8d11f6b58c4549976a513b2b4dc6df2, 8dbfc14fc736eb701089aff09645c3d4ad3decb1 ≤ v < 51a0e8399858621442807a26057bcd1cd3ced046, 1e8087589b5cf6fa17adaf57b64cf1656d77dfec, 6.1.43 ≤ v < 6.1.191, 6.4.8 ≤ v < 6.5, 6.5 | aa72cc4675240ab6b01ec72ac6a1fe832e715569, ca05d9abde2195cec3d07d0d4d65152d8171078f, 3a69fae2371a5ee190d4c4bbe5304a753558c1c6, 969a96479add6bd42d7f7241f99f27b31571a953, 076349e4c8d11f6b58c4549976a513b2b4dc6df2, 51a0e8399858621442807a26057bcd1cd3ced046, 6.1.191, 6.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.