CVE-2026-74321

A flaw was found in the btrfs file system component of the Linux kernel. This vulnerability occurs in the __btrfs_run_delayed_refs() function when an error condition is not properly handled, leading to an invalid pointer dereference. A local attacker could potentially exploit this flaw to cause a system crash, resulting in a Denial of Service (DoS).

A flaw rated Moderate severity by Red Hat was found in the btrfs file system component of the Linux kernel as shipped in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. In __btrfs_run_delayed_refs(), when btrfs_select_ref_head() returns ERR_PTR(-EAGAIN), the 'locked_ref' variable retains the error pointer instead of being reset to NULL; on the next loop iteration the error pointer is treated as a valid delayed reference head and spin_lock() is called on it, causing an invalid pointer dereference and a kernel crash. A local attacker able to perform filesystem operations on a mounted btrfs file system could use this flaw to crash the system, resulting in a denial of service; there is no impact to confidentiality or integrity. Red Hat Enterprise Linux 7, 8, and 9 are not affected because the vulnerable code, introduced when an upstream refactoring of the __btrfs_run_delayed_refs() loop unintentionally removed existing safeguards, is not present in those kernels, and Red Hat Enterprise Linux 6 is out of support scope. Red Hat rated this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream CVE.org rating of 7.5, because exploiting this flaw requires local access to a system with a btrfs file system mounted and is not network reachable. The fix for the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams is currently deferred because the issue is a local denial of service with limited practical impact; the residual risk is that a local user with access to a btrfs file system could trigger a kernel crash and system outage on an affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.