CVE-2026-74571
- Source
- https://cve.org/CVERecord?id=CVE-2026-74571
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74571.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-74571
- Downstream
AZL (1)
BELL (1)
DEBIAN (1)
openSUSE (1)
SUSE (10)
UBUNTU (1)
- Related
- Published
- 2026-08-15T12:28:10Z
- Modified
- 2026-10-08T02:51:54Z
- Summary
- btrfs: skip global block reserve accounting for rescue mounts
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
btrfs: skip global block reserve accounting for rescue mounts
[BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000100 RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs] Call Trace: fill_dummy_bgs+0xd4/0x120 [btrfs] open_ctree+0xc6e/0x1ca0 [btrfs] btrfs_get_tree+0x50d/0xa40 [btrfs]
The same crash occurs with a corrupted raid stripe tree root, via btrfs_read_block_groups() instead of fill_dummy_bgs().
[CAUSE] With rescue=ibadroots, btrfs_read_roots() allows the mount to continue when either root cannot be read, leaving the corresponding root pointer NULL while its on-disk feature bit remains set.
btrfs_update_global_block_rsv() then dereferences the missing root based on the feature bit alone.
[FIX] Rescue mounts are fully read-only and cannot start transactions, so the global reserve is never consumed. Under btrfs_is_full_ro(), mark the reserve as full and return before performing the accounting.
And since we need to check if the fs is mount fully RO, export fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.
[ Squash the fs_is_full_ro() export commit into this one. ]
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74571.json" }- References
-
- https://git.kernel.org/stable/c/076349e4c8d11f6b58c4549976a513b2b4dc6df2
- https://git.kernel.org/stable/c/51a0e8399858621442807a26057bcd1cd3ced046
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74571.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-74571
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8dbfc14fc736eb701089aff09645c3d4ad3decb1Fixed076349e4c8d11f6b58c4549976a513b2b4dc6df2Fixed51a0e8399858621442807a26057bcd1cd3ced046
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.1.43Fixed6.2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.4.8Fixed6.5
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedcbec34d3021d47007a0334c634f7053dbaf93d02
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1e8087589b5cf6fa17adaf57b64cf1656d77dfec