GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74318 (GCVE-0-2026-74318)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:17
VLAI
Title
btrfs: fix deadlock cloning inline extent when using flushoncommit
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock cloning inline extent when using flushoncommit In commit b48c980b6a7e ("btrfs: fix deadlock between reflink and transaction commit when using flushoncommit") a deadlock was fixed between reflinks and transaction commits when the fs is mounted with the flushoncommit option. This happened when we had to copy an inline extent's data to the destination file. However the issue was fixed only for the case where the destination offset is 0, it missed the case when the offset is greater than zero. Fix this by ensuring we get i_size update whenever we copied an inline extent's data into the destination file. Syzbot reported this with the following trace: INFO: task kworker/u8:3:57 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:3 state:D stack:21600 pid:57 tgid:57 ppid:2 task_flags:0x4208160 flags:0x00080000 Workqueue: writeback wb_workfn (flush-btrfs-129) Call Trace: <TASK> context_switch kernel/sched/core.c:5402 [inline] __schedule+0x16f9/0x5500 kernel/sched/core.c:7204 __schedule_loop kernel/sched/core.c:7283 [inline] schedule+0x164/0x360 kernel/sched/core.c:7298 wait_extent_bit fs/btrfs/extent-io-tree.c:905 [inline] btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:2008 btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline] btrfs_invalidate_folio+0x440/0xc00 fs/btrfs/inode.c:7718 extent_writepage fs/btrfs/extent_io.c:1848 [inline] extent_write_cache_pages fs/btrfs/extent_io.c:2552 [inline] btrfs_writepages+0x12f3/0x2410 fs/btrfs/extent_io.c:2684 do_writepages+0x32e/0x550 mm/page-writeback.c:2571 __writeback_single_inode+0x133/0x10e0 fs/fs-writeback.c:1764 writeback_sb_inodes+0x97f/0x1980 fs/fs-writeback.c:2056 wb_writeback+0x445/0xb00 fs/fs-writeback.c:2241 wb_do_writeback fs/fs-writeback.c:2388 [inline] wb_workfn+0x3fd/0xf20 fs/fs-writeback.c:2428 process_one_work+0x98b/0x1630 kernel/workqueue.c:3318 process_scheduled_works kernel/workqueue.c:3401 [inline] worker_thread+0xb49/0x1140 kernel/workqueue.c:3482 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> INFO: task syz.0.145:8523 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.145 state:D stack:22752 pid:8523 tgid:8522 ppid:5850 task_flags:0x400140 flags:0x00080002 Call Trace: <TASK> context_switch kernel/sched/core.c:5402 [inline] __schedule+0x16f9/0x5500 kernel/sched/core.c:7204 __schedule_loop kernel/sched/core.c:7283 [inline] schedule+0x164/0x360 kernel/sched/core.c:7298 wb_wait_for_completion+0x3e8/0x790 fs/fs-writeback.c:227 __writeback_inodes_sb_nr+0x24c/0x2d0 fs/fs-writeback.c:2847 try_to_writeback_inodes_sb+0x9a/0xc0 fs/fs-writeback.c:2895 btrfs_start_delalloc_flush fs/btrfs/transaction.c:2182 [inline] btrfs_commit_transaction+0x813/0x2fc0 fs/btrfs/transaction.c:2371 btrfs_sync_file+0xdf4/0x1230 fs/btrfs/file.c:1822 generic_write_sync include/linux/fs.h:2663 [inline] btrfs_do_write_iter+0x6a9/0x840 fs/btrfs/file.c:1473 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x629/0xba0 fs/read_write.c:688 ksys_write+0x156/0x270 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x15f/0x560 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5a0bdece59 RSP: 002b:00007f5a0b446028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f5a0c065fa0 RCX: 00007f5a0bdece59 RDX: 000000000000029f RSI: 0000200000 ---truncated---
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 05a5a7621ce66c142e081ffc24dd6ade6e912061 , < 06283034cec0fa357cbd85784ef7d3f5b2ce0790 (git)
Affected: 05a5a7621ce66c142e081ffc24dd6ade6e912061 , < 2aa37c8ef1092c6f088e23a90bffefc672831c09 (git)
Affected: 05a5a7621ce66c142e081ffc24dd6ade6e912061 , < ea3452726ccb6bcaa732f43cc57bb928eca3dd59 (git)
Affected: 05a5a7621ce66c142e081ffc24dd6ade6e912061 , < 532085d00eb54c074bdeae648b194765239f4d11 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/reflink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "06283034cec0fa357cbd85784ef7d3f5b2ce0790",
              "status": "affected",
              "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
              "versionType": "git"
            },
            {
              "lessThan": "2aa37c8ef1092c6f088e23a90bffefc672831c09",
              "status": "affected",
              "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
              "versionType": "git"
            },
            {
              "lessThan": "ea3452726ccb6bcaa732f43cc57bb928eca3dd59",
              "status": "affected",
              "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
              "versionType": "git"
            },
            {
              "lessThan": "532085d00eb54c074bdeae648b194765239f4d11",
              "status": "affected",
              "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/reflink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock cloning inline extent when using flushoncommit\n\nIn commit b48c980b6a7e (\"btrfs: fix deadlock between reflink and\ntransaction commit when using flushoncommit\") a deadlock was fixed\nbetween reflinks and transaction commits when the fs is mounted with the\nflushoncommit option. This happened when we had to copy an inline extent\u0027s\ndata to the destination file. However the issue was fixed only for the\ncase where the destination offset is 0, it missed the case when the offset\nis greater than zero.\n\nFix this by ensuring we get i_size update whenever we copied an inline\nextent\u0027s data into the destination file.\n\nSyzbot reported this with the following trace:\n\n   INFO: task kworker/u8:3:57 blocked for more than 143 seconds.\n         Not tainted syzkaller #0\n   \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n   task:kworker/u8:3    state:D stack:21600 pid:57    tgid:57    ppid:2      task_flags:0x4208160 flags:0x00080000\n   Workqueue: writeback wb_workfn (flush-btrfs-129)\n   Call Trace:\n    \u003cTASK\u003e\n    context_switch kernel/sched/core.c:5402 [inline]\n    __schedule+0x16f9/0x5500 kernel/sched/core.c:7204\n    __schedule_loop kernel/sched/core.c:7283 [inline]\n    schedule+0x164/0x360 kernel/sched/core.c:7298\n    wait_extent_bit fs/btrfs/extent-io-tree.c:905 [inline]\n    btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:2008\n    btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline]\n    btrfs_invalidate_folio+0x440/0xc00 fs/btrfs/inode.c:7718\n    extent_writepage fs/btrfs/extent_io.c:1848 [inline]\n    extent_write_cache_pages fs/btrfs/extent_io.c:2552 [inline]\n    btrfs_writepages+0x12f3/0x2410 fs/btrfs/extent_io.c:2684\n    do_writepages+0x32e/0x550 mm/page-writeback.c:2571\n    __writeback_single_inode+0x133/0x10e0 fs/fs-writeback.c:1764\n    writeback_sb_inodes+0x97f/0x1980 fs/fs-writeback.c:2056\n    wb_writeback+0x445/0xb00 fs/fs-writeback.c:2241\n    wb_do_writeback fs/fs-writeback.c:2388 [inline]\n    wb_workfn+0x3fd/0xf20 fs/fs-writeback.c:2428\n    process_one_work+0x98b/0x1630 kernel/workqueue.c:3318\n    process_scheduled_works kernel/workqueue.c:3401 [inline]\n    worker_thread+0xb49/0x1140 kernel/workqueue.c:3482\n    kthread+0x388/0x470 kernel/kthread.c:436\n    ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n    \u003c/TASK\u003e\n   INFO: task syz.0.145:8523 blocked for more than 143 seconds.\n         Not tainted syzkaller #0\n   \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n   task:syz.0.145       state:D stack:22752 pid:8523  tgid:8522  ppid:5850   task_flags:0x400140 flags:0x00080002\n   Call Trace:\n    \u003cTASK\u003e\n    context_switch kernel/sched/core.c:5402 [inline]\n    __schedule+0x16f9/0x5500 kernel/sched/core.c:7204\n    __schedule_loop kernel/sched/core.c:7283 [inline]\n    schedule+0x164/0x360 kernel/sched/core.c:7298\n    wb_wait_for_completion+0x3e8/0x790 fs/fs-writeback.c:227\n    __writeback_inodes_sb_nr+0x24c/0x2d0 fs/fs-writeback.c:2847\n    try_to_writeback_inodes_sb+0x9a/0xc0 fs/fs-writeback.c:2895\n    btrfs_start_delalloc_flush fs/btrfs/transaction.c:2182 [inline]\n    btrfs_commit_transaction+0x813/0x2fc0 fs/btrfs/transaction.c:2371\n    btrfs_sync_file+0xdf4/0x1230 fs/btrfs/file.c:1822\n    generic_write_sync include/linux/fs.h:2663 [inline]\n    btrfs_do_write_iter+0x6a9/0x840 fs/btrfs/file.c:1473\n    new_sync_write fs/read_write.c:595 [inline]\n    vfs_write+0x629/0xba0 fs/read_write.c:688\n    ksys_write+0x156/0x270 fs/read_write.c:740\n    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n    do_syscall_64+0x15f/0x560 arch/x86/entry/syscall_64.c:94\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   RIP: 0033:0x7f5a0bdece59\n   RSP: 002b:00007f5a0b446028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n   RAX: ffffffffffffffda RBX: 00007f5a0c065fa0 RCX: 00007f5a0bdece59\n   RDX: 000000000000029f RSI: 0000200000\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:17:08.156Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/06283034cec0fa357cbd85784ef7d3f5b2ce0790"
        },
        {
          "url": "https://git.kernel.org/stable/c/2aa37c8ef1092c6f088e23a90bffefc672831c09"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea3452726ccb6bcaa732f43cc57bb928eca3dd59"
        },
        {
          "url": "https://git.kernel.org/stable/c/532085d00eb54c074bdeae648b194765239f4d11"
        }
      ],
      "title": "btrfs: fix deadlock cloning inline extent when using flushoncommit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74318",
    "datePublished": "2026-08-15T05:58:15.499Z",
    "dateReserved": "2026-08-15T05:44:03.884Z",
    "dateUpdated": "2026-08-17T05:17:08.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74318",
      "date": "2026-09-05",
      "epss": "0.00168",
      "percentile": "0.06329"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74318\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:32.177\",\"lastModified\":\"2026-08-17T06:19:26.207\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix deadlock cloning inline extent when using flushoncommit\\n\\nIn commit b48c980b6a7e (\\\"btrfs: fix deadlock between reflink and\\ntransaction commit when using flushoncommit\\\") a deadlock was fixed\\nbetween reflinks and transaction commits when the fs is mounted with the\\nflushoncommit option. This happened when we had to copy an inline extent\u0027s\\ndata to the destination file. However the issue was fixed only for the\\ncase where the destination offset is 0, it missed the case when the offset\\nis greater than zero.\\n\\nFix this by ensuring we get i_size update whenever we copied an inline\\nextent\u0027s data into the destination file.\\n\\nSyzbot reported this with the following trace:\\n\\n   INFO: task kworker/u8:3:57 blocked for more than 143 seconds.\\n         Not tainted syzkaller #0\\n   \\\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\\\" disables this message.\\n   task:kworker/u8:3    state:D stack:21600 pid:57    tgid:57    ppid:2      task_flags:0x4208160 flags:0x00080000\\n   Workqueue: writeback wb_workfn (flush-btrfs-129)\\n   Call Trace:\\n    \u003cTASK\u003e\\n    context_switch kernel/sched/core.c:5402 [inline]\\n    __schedule+0x16f9/0x5500 kernel/sched/core.c:7204\\n    __schedule_loop kernel/sched/core.c:7283 [inline]\\n    schedule+0x164/0x360 kernel/sched/core.c:7298\\n    wait_extent_bit fs/btrfs/extent-io-tree.c:905 [inline]\\n    btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:2008\\n    btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline]\\n    btrfs_invalidate_folio+0x440/0xc00 fs/btrfs/inode.c:7718\\n    extent_writepage fs/btrfs/extent_io.c:1848 [inline]\\n    extent_write_cache_pages fs/btrfs/extent_io.c:2552 [inline]\\n    btrfs_writepages+0x12f3/0x2410 fs/btrfs/extent_io.c:2684\\n    do_writepages+0x32e/0x550 mm/page-writeback.c:2571\\n    __writeback_single_inode+0x133/0x10e0 fs/fs-writeback.c:1764\\n    writeback_sb_inodes+0x97f/0x1980 fs/fs-writeback.c:2056\\n    wb_writeback+0x445/0xb00 fs/fs-writeback.c:2241\\n    wb_do_writeback fs/fs-writeback.c:2388 [inline]\\n    wb_workfn+0x3fd/0xf20 fs/fs-writeback.c:2428\\n    process_one_work+0x98b/0x1630 kernel/workqueue.c:3318\\n    process_scheduled_works kernel/workqueue.c:3401 [inline]\\n    worker_thread+0xb49/0x1140 kernel/workqueue.c:3482\\n    kthread+0x388/0x470 kernel/kthread.c:436\\n    ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\\n    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\\n    \u003c/TASK\u003e\\n   INFO: task syz.0.145:8523 blocked for more than 143 seconds.\\n         Not tainted syzkaller #0\\n   \\\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\\\" disables this message.\\n   task:syz.0.145       state:D stack:22752 pid:8523  tgid:8522  ppid:5850   task_flags:0x400140 flags:0x00080002\\n   Call Trace:\\n    \u003cTASK\u003e\\n    context_switch kernel/sched/core.c:5402 [inline]\\n    __schedule+0x16f9/0x5500 kernel/sched/core.c:7204\\n    __schedule_loop kernel/sched/core.c:7283 [inline]\\n    schedule+0x164/0x360 kernel/sched/core.c:7298\\n    wb_wait_for_completion+0x3e8/0x790 fs/fs-writeback.c:227\\n    __writeback_inodes_sb_nr+0x24c/0x2d0 fs/fs-writeback.c:2847\\n    try_to_writeback_inodes_sb+0x9a/0xc0 fs/fs-writeback.c:2895\\n    btrfs_start_delalloc_flush fs/btrfs/transaction.c:2182 [inline]\\n    btrfs_commit_transaction+0x813/0x2fc0 fs/btrfs/transaction.c:2371\\n    btrfs_sync_file+0xdf4/0x1230 fs/btrfs/file.c:1822\\n    generic_write_sync include/linux/fs.h:2663 [inline]\\n    btrfs_do_write_iter+0x6a9/0x840 fs/btrfs/file.c:1473\\n    new_sync_write fs/read_write.c:595 [inline]\\n    vfs_write+0x629/0xba0 fs/read_write.c:688\\n    ksys_write+0x156/0x270 fs/read_write.c:740\\n    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n    do_syscall_64+0x15f/0x560 arch/x86/entry/syscall_64.c:94\\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n   RIP: 0033:0x7f5a0bdece59\\n   RSP: 002b:00007f5a0b446028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\\n   RAX: ffffffffffffffda RBX: 00007f5a0c065fa0 RCX: 00007f5a0bdece59\\n   RDX: 000000000000029f RSI: 0000200000\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/reflink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"05a5a7621ce66c142e081ffc24dd6ade6e912061\",\"lessThan\":\"06283034cec0fa357cbd85784ef7d3f5b2ce0790\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"05a5a7621ce66c142e081ffc24dd6ade6e912061\",\"lessThan\":\"2aa37c8ef1092c6f088e23a90bffefc672831c09\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"05a5a7621ce66c142e081ffc24dd6ade6e912061\",\"lessThan\":\"ea3452726ccb6bcaa732f43cc57bb928eca3dd59\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"05a5a7621ce66c142e081ffc24dd6ade6e912061\",\"lessThan\":\"532085d00eb54c074bdeae648b194765239f4d11\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/reflink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06283034cec0fa357cbd85784ef7d3f5b2ce0790\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2aa37c8ef1092c6f088e23a90bffefc672831c09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/532085d00eb54c074bdeae648b194765239f4d11\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea3452726ccb6bcaa732f43cc57bb928eca3dd59\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T11:17:13+00:00",
      "cve": "CVE-2026-74318",
      "id": "CVE-2026-74318",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix deadlock cloning inline extent when using flushoncommit",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74318.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.