CVE-2026-74321

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix invalid pointer dereference in _btrfsrundelayedrefs()

In the beginning of the loop, we try to obtain a locked delayed ref head, if 'lockedref' is currently NULL, by calling btrfsselectrefhead(), which can return an error pointer. If the error pointer is -EAGAIN we do a continue and go back to the beginning of the loop, which will not try again to call btrfsselectrefhead() since 'lockedref' is no longer NULL but it's ERR_PTR(-EAGAIN), and then we do:

spinlock(&lockedref->lock);

against a ERR_PTR(-EAGAIN) value, generating an invalid pointer dereference.

Fix this by ensuring that 'lockedref' is set to NULL when btrfsselectrefhead() returns ERRPTR(-EAGAIN) and incrementing 'count' as well, to prevent infinite looping. We do this by doing a goto to the bottom of the loop that already sets 'lockedref' to NULL and does a cond_resched(), with an increment to 'count' right before the goto. These measures were in place before the refactoring in commit 0110a4c43451 ("btrfs: refactor _btrfsrundelayedrefs loop") but were unintentionally lost afterwards.