CVE-2026-90260

A flaw was found in the Linux kernel's Btrfs zoned filesystem. When a freed-but-still-dirty tree block is written out as zeros, the btree_csum_one_bio() function improperly clears the extent buffer's in-memory content. This can lead to corruption of the extent tree, potentially causing system instability or a denial of service (DoS) due to an "unable to find ref" error or an assertion failure.

On a zoned Btrfs filesystem, a freed but still dirty tree block can be scheduled for a zero write only to advance the zone write pointer. The old path zeroed the folios owned by the live extent buffer, even though later code could still read its header. A later call to btrfs_free_tree_block can therefore observe a zero bytenr, create an invalid delayed reference, corrupt the extent tree, trigger an assertion or abort the filesystem. For the CVSS the PR:L reflects that an unprivileged local user with write access to an already mounted affected filesystem may be able to generate the required filesystem workload. Creating and mounting the zoned Btrfs filesystem still normally requires administrative setup. The issue is not directly network reachable. The demonstrated impact includes filesystem metadata corruption and denial of service. Limited confidentiality impact is retained only in the paranoid score because corrupted extent metadata could theoretically cause incorrect data references, but the supplied code does not establish a reliable disclosure primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.