CVE-2026-53122

A flaw was found in the Linux kernel's Btrfs file system. A local user could exploit this vulnerability to cause a Denial of Service (DoS) by triggering a system hang. This issue occurs when performing concurrent file cloning (reflink) operations and transaction commits on a file system mounted with the flushoncommit option, causing conflicting locks between file extent updates and background writeback operations. Consequently, the affected tasks become indefinitely blocked in an unrecoverable kernel deadlock.

This vulnerability is rated as Moderate severity because exploitation requires local access and can trigger a kernel deadlock resulting in a denial of service, but it cannot be initiated remotely nor does it permit code execution or data leakage. Exploiting the issue depends on mounting a Btrfs filesystem with the non-default flushoncommit option while performing concurrent file reflink actions and transaction commits. In addition, Btrfs is not supported in Red Hat Enterprise Linux and the vulnerable code sequence is not present in standard RHEL 8 and 9 kernel releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.