CVE-2026-23036
kernel: btrfs: release path before iget_failed() in btrfs_read_locked_inode()
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · January 31, 2026
Updated · June 28, 2026
Description
An ABBA deadlock vulnerability was found in the Linux kernel's Btrfs filesystem. When btrfs_read_locked_inode() fails to lookup an inode, it calls iget_failed() while still holding a read-locked btree leaf. Since iget_failed() triggers inode eviction which needs the delayed_node mutex, and delayed inode updates hold the mutex while modifying the btree, a circular lock dependency occurs leading to deadlock.
Statement
This deadlock was discovered by syzbot and affects Btrfs filesystem operations that fail during inode lookup. The lock order violation between btrfs-tree-00 and delayed_node->mutex can cause the system to hang. Triggering requires specific error conditions during inode operations that cause the lookup to fail.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-821 · Incorrect Synchronization