CVE-2026-90264

A flaw was found in the Linux kernel's btrfs filesystem. A race condition can occur when direct I/O operations complete prematurely, causing the system to fail to properly wait for existing ordered extents (OEs) to be cleared. This can lead to conflicting OEs for the same data range. A local attacker could exploit this race condition, triggering a kernel panic and resulting in a Denial of Service (DoS).

A MODERATE severity race condition flaw was found in the Linux kernel's btrfs filesystem. When a direct I/O append write finishes short, the kernel reverts the file size before falling back to a buffered write, and under this condition the buffered write path may skip waiting for a still-outstanding direct I/O ordered extent. This allows two ordered extents to be inserted for the same file range, triggering a kernel BUG and panic. A local attacker able to perform file writes on a mounted btrfs filesystem could exploit this race to crash the system, resulting in a denial of service. The vulnerable code, introduced by a recent upstream btrfs direct I/O change, is not present in the Linux kernel versions shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 (including kernel-rt), Red Hat In-Vehicle OS, or the RHEL CoreOS images used by OpenShift Container Platform, so those products are not affected. The Red Hat Enterprise Linux 6 ELS kernel is recorded as out of support scope for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.