CVE-2026-74572
Description
A flaw was found in the Linux kernel's btrfs zoned filesystem. A local user could trigger a deadlock when metadata writeback and transaction commit operations occur simultaneously. This deadlock causes the system to hang, leading to a Denial of Service (DoS).
Statement
A moderate severity flaw was found in the Linux kernel's btrfs zoned filesystem implementation. When writing out metadata on a zoned btrfs filesystem, btree_writepages() holds the zoned_meta_io_lock across a tree-log zone activation path that waits for the running transaction to commit, while the transaction committer simultaneously blocks waiting for that same lock to write out tree extents. The two tasks deadlock, causing the system to hang and resulting in a denial of service. A local user able to perform filesystem operations on a mounted zoned btrfs filesystem can trigger this deadlock. Red Hat Product Security rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access to a system with a zoned btrfs filesystem; this differs from the upstream CVE record, which assigns a higher score (7.5) using a network attack vector that does not match the local nature of this issue. Red Hat Enterprise Linux 6, 7, 8, and 9 are not affected because the vulnerable code is not present in those streams. The affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS kernel streams have a deferred fix; until a fix is released, the residual risk is a local denial of service limited to systems using zoned btrfs filesystems, with no impact on confidentiality or integrity.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.5 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
