Vulnerability-Lookup

GHSA-3XV6-4M2C-PHMW

Vulnerability from github – Published: 2026-09-17 18:31 – Updated: 2026-10-21 15:41

Details

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: don't clobber the extent buffer when zeroing it out

On a zoned filesystem a freed-but-still-dirty tree block is written out as zeros (EXTENT_BUFFER_ZONED_ZEROOUT) only to keep the zone write pointer advancing. btree_csum_one_bio() implemented this by memzeroing the extent buffer's own folios before submission.

That destroys the in-memory buffer while it may still be referenced. In particular btrfs_free_tree_block() can run on it afterwards and reads the header to add a delayed reference; once the header has been zeroed it frees bytenr 0 and corrupts the extent tree (the btrfs_header_bytenr(buf) != 0 ASSERT in btrfs_free_tree_block(), or an "unable to find ref" abort). It is flaky and reproduces under fsstress, e.g. generic/461 and generic/013.

Write the zeros to disk from the shared zero page instead and leave the extent buffer content untouched, so any later reference - including the delayed reference from btrfs_free_tree_block() - still sees a valid header. end_bbio_meta_write() now clears writeback on the buffer's own folios, as the bio no longer carries them.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-90260"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-17T17:17:22Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: don\u0027t clobber the extent buffer when zeroing it out\n\nOn a zoned filesystem a freed-but-still-dirty tree block is written out\nas zeros (EXTENT_BUFFER_ZONED_ZEROOUT) only to keep the zone write\npointer advancing. btree_csum_one_bio() implemented this by memzeroing\nthe extent buffer\u0027s own folios before submission.\n\nThat destroys the in-memory buffer while it may still be referenced. In\nparticular btrfs_free_tree_block() can run on it afterwards and reads\nthe header to add a delayed reference; once the header has been zeroed\nit frees bytenr 0 and corrupts the extent tree (the\nbtrfs_header_bytenr(buf) != 0 ASSERT in btrfs_free_tree_block(), or an\n\"unable to find ref\" abort). It is flaky and reproduces under fsstress,\ne.g. generic/461 and generic/013.\n\nWrite the zeros to disk from the shared zero page instead and leave the\nextent buffer content untouched, so any later reference - including the\ndelayed reference from btrfs_free_tree_block() - still sees a valid\nheader. end_bbio_meta_write() now clears writeback on the buffer\u0027s own\nfolios, as the bio no longer carries them.",
  "id": "GHSA-3xv6-4m2c-phmw",
  "modified": "2026-10-21T15:41:22Z",
  "published": "2026-09-17T18:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90260"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/92484ad014f2e2b0e0e7bbc1610951e978cf557c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/98e3747587f9f87f010d8d7e55786216249a94af"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/db4b9eefc8ee0bcaeee4d5e6a7313905f6a2fe7c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/efa5084d08030aa557fdefa3e4a73b2501b7d207"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-90260 (GCVE-0-2026-90260)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-10-21 12:50

Title

btrfs: zoned: don't clobber the extent buffer when zeroing it out

Summary

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't clobber the extent buffer when zeroing it out On a zoned filesystem a freed-but-still-dirty tree block is written out as zeros (EXTENT_BUFFER_ZONED_ZEROOUT) only to keep the zone write pointer advancing. btree_csum_one_bio() implemented this by memzeroing the extent buffer's own folios before submission. That destroys the in-memory buffer while it may still be referenced. In particular btrfs_free_tree_block() can run on it afterwards and reads the header to add a delayed reference; once the header has been zeroed it frees bytenr 0 and corrupts the extent tree (the btrfs_header_bytenr(buf) != 0 ASSERT in btrfs_free_tree_block(), or an "unable to find ref" abort). It is flaky and reproduces under fsstress, e.g. generic/461 and generic/013. Write the zeros to disk from the shared zero page instead and leave the extent buffer content untouched, so any later reference - including the delayed reference from btrfs_free_tree_block() - still sees a valid header. end_bbio_meta_write() now clears writeback on the buffer's own folios, as the bio no longer carries them.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/efa5084d08030aa55…
https://git.kernel.org/stable/c/92484ad014f2e2b0e…
https://git.kernel.org/stable/c/98e3747587f9f87f0…
https://git.kernel.org/stable/c/db4b9eefc8ee0bcae…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: aa6313e6ff2bfbf736a2739047bba355d8241584 , < efa5084d08030aa557fdefa3e4a73b2501b7d207 (git) Affected: aa6313e6ff2bfbf736a2739047bba355d8241584 , < 92484ad014f2e2b0e0e7bbc1610951e978cf557c (git) Affected: aa6313e6ff2bfbf736a2739047bba355d8241584 , < 98e3747587f9f87f010d8d7e55786216249a94af (git) Affected: aa6313e6ff2bfbf736a2739047bba355d8241584 , < db4b9eefc8ee0bcaeee4d5e6a7313905f6a2fe7c (git)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.114 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/disk-io.c",
            "fs/btrfs/extent_io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "efa5084d08030aa557fdefa3e4a73b2501b7d207",
              "status": "affected",
              "version": "aa6313e6ff2bfbf736a2739047bba355d8241584",
              "versionType": "git"
            },
            {
              "lessThan": "92484ad014f2e2b0e0e7bbc1610951e978cf557c",
              "status": "affected",
              "version": "aa6313e6ff2bfbf736a2739047bba355d8241584",
              "versionType": "git"
            },
            {
              "lessThan": "98e3747587f9f87f010d8d7e55786216249a94af",
              "status": "affected",
              "version": "aa6313e6ff2bfbf736a2739047bba355d8241584",
              "versionType": "git"
            },
            {
              "lessThan": "db4b9eefc8ee0bcaeee4d5e6a7313905f6a2fe7c",
              "status": "affected",
              "version": "aa6313e6ff2bfbf736a2739047bba355d8241584",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/disk-io.c",
            "fs/btrfs/extent_io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: don\u0027t clobber the extent buffer when zeroing it out\n\nOn a zoned filesystem a freed-but-still-dirty tree block is written out\nas zeros (EXTENT_BUFFER_ZONED_ZEROOUT) only to keep the zone write\npointer advancing. btree_csum_one_bio() implemented this by memzeroing\nthe extent buffer\u0027s own folios before submission.\n\nThat destroys the in-memory buffer while it may still be referenced. In\nparticular btrfs_free_tree_block() can run on it afterwards and reads\nthe header to add a delayed reference; once the header has been zeroed\nit frees bytenr 0 and corrupts the extent tree (the\nbtrfs_header_bytenr(buf) != 0 ASSERT in btrfs_free_tree_block(), or an\n\"unable to find ref\" abort). It is flaky and reproduces under fsstress,\ne.g. generic/461 and generic/013.\n\nWrite the zeros to disk from the shared zero page instead and leave the\nextent buffer content untouched, so any later reference - including the\ndelayed reference from btrfs_free_tree_block() - still sees a valid\nheader. end_bbio_meta_write() now clears writeback on the buffer\u0027s own\nfolios, as the bio no longer carries them."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is local VFS syscalls on a mounted zoned btrfs: unlink \u2192 btrfs_unlink() \u2192 btrfs_del_items() \u2192 btrfs_clear_buffer_dirty() sets EXTENT_BUFFER_ZONED_ZEROOUT, then fsync \u2192 btrfs_sync_file() \u2192 btree_writepages() \u2192 write_one_eb() \u2192 btree_csum_one_bio(). No network protocol carries the data that causes the clobber.\nAC:L - The attacker drives both sides: unlink/write churn that sets ZONED_ZEROOUT in btrfs_clear_buffer_dirty() while leaving DIRTY set, and fsync or btrfs_btree_balance_dirty() running btree_writepages(). lock_extent_buffer_for_io() drops the tree lock before the memzero, and btrfs_del_leaf() unlocks before btrfs_free_tree_block() reads the header.\nPR:L - btrfs_unlink() and btrfs_sync_file() have no capability check; an unprivileged user with write access on the already-mounted zoned volume can COW-free tree blocks and kick metadata writeback (fsync or the btrfs_btree_balance_dirty() at the end of btrfs_unlink()).\nUI:N - The attacker performs the unlink/write/fsync sequence themselves on files they can write; this is a runtime COW/writeback race on a legitimate zoned btrfs (reproduced by fsstress generic/461 and generic/013), not a crafted image a victim must mount.\nS:U - The clobbered extent-buffer folios and the bad delayed refs stay inside this mount\u0027s btrfs metadata in the host kernel; there is no KVM/Xen guest-to-host, IOMMU, or sandbox boundary crossing.\nC:N - btree_csum_one_bio() calls memzero_extent_buffer(eb, 0, eb-\u003elen), which memset_extent_buffer() restricts to that buffer\u0027s own folios via check_eb_range(); the overwrite is zeros, not an out-of-bounds read or kernel-pointer leak.\nI:H - After the header is zeroed, btrfs_free_tree_block() queues a BTRFS_DROP_DELAYED_REF with owning_root=btrfs_header_owner(buf)==0 and level=btrfs_header_level(buf)==0, so __btrfs_free_extent() applies a mismatched backref to the shared extent tree and corrupts metadata for every file on the volume.\nA:H - The mismatched delayed ref hits abort_and_dump() \u2192 btrfs_abort_transaction(-EUCLEAN) \u2192 __btrfs_handle_fs_error() \u2192 btrfs_set_sb_rdonly(), forcing the whole filesystem read-only; with CONFIG_BTRFS_ASSERT, ASSERT(btrfs_header_bytenr(buf) != 0) in btrfs_free_tree_block() panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:50:42.251Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/efa5084d08030aa557fdefa3e4a73b2501b7d207"
        },
        {
          "url": "https://git.kernel.org/stable/c/92484ad014f2e2b0e0e7bbc1610951e978cf557c"
        },
        {
          "url": "https://git.kernel.org/stable/c/98e3747587f9f87f010d8d7e55786216249a94af"
        },
        {
          "url": "https://git.kernel.org/stable/c/db4b9eefc8ee0bcaeee4d5e6a7313905f6a2fe7c"
        }
      ],
      "title": "btrfs: zoned: don\u0027t clobber the extent buffer when zeroing it out",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90260",
    "datePublished": "2026-09-17T16:07:58.102Z",
    "dateReserved": "2026-09-11T19:38:34.796Z",
    "dateUpdated": "2026-10-21T12:50:42.251Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted