CVE-2026-74318

A flaw was found in the Linux kernel's btrfs filesystem. A local user could trigger a deadlock when cloning an inline extent with the flushoncommit mount option, specifically when the destination offset is greater than zero. This issue occurs due to a missing i_size update during the copy operation. Successful exploitation of this flaw could lead to a system hang, resulting in a Denial of Service (DoS).

A low impact deadlock flaw was found in the Linux kernel's btrfs filesystem implementation. When a btrfs filesystem is mounted with the flushoncommit option, a local user who can perform file clone (reflink) operations can trigger a deadlock by cloning an inline extent to a destination offset greater than zero. The clone path fails to update the inode size (i_size) after copying the inline extent's data, which allows the clone operation to deadlock with transaction commit and writeback, leaving the blocked tasks hung indefinitely and resulting in a denial of service. Only system availability is affected; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 10 (kernel) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm components) contain the vulnerable code and are affected. For these products the fix is deferred to a future update because the flaw is of low security impact: exploitation requires local access to a system with a btrfs filesystem mounted with the flushoncommit option, and it can only hang the system rather than compromise data. The residual risk while the fix is deferred is that such a local user could trigger the deadlock and hang the system. Red Hat Enterprise Linux 6, 7, 8, and 9 (kernel and kernel-rt) are not affected because the vulnerable code is not present in their kernels. Red Hat rates this flaw with a CVSS:3.1 base score of 5.5, Moderate (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting the local, availability-only nature of the issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This deadlock is only reachable on a btrfs filesystem that is mounted with the flushoncommit option, so the issue can be avoided by not using that option: remove flushoncommit from the filesystem's mount options (for example, in /etc/fstab) and mount or remount the filesystem without it. The fix for the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 kernels is currently deferred and is planned to be delivered in a future update.