CVE Database›CVE-2026-23036

CVE-2026-23036

kernel: btrfs: release path before iget_failed() in btrfs_read_locked_inode()

Loading…

Severity

Low

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · January 31, 2026

Updated · June 28, 2026

Description

An ABBA deadlock vulnerability was found in the Linux kernel's Btrfs filesystem. When btrfs_read_locked_inode() fails to lookup an inode, it calls iget_failed() while still holding a read-locked btree leaf. Since iget_failed() triggers inode eviction which needs the delayed_node mutex, and delayed inode updates hold the mutex while modifying the btree, a circular lock dependency occurs leading to deadlock.

Statement

This deadlock was discovered by syzbot and affects Btrfs filesystem operations that fail during inode lookup. The lock order violation between btrfs-tree-00 and delayed_node->mutex can cause the system to hang. Triggering requires specific error conditions during inode operations that cause the lookup to fail.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-821 · Incorrect Synchronization