CVE-2026-90265

A flaw was found in the btrfs filesystem within the Linux kernel. A local user could trigger a deadlock during file defragmentation when the system attempts to reserve delayed allocation space while holding dirty and locked data. This condition can cause the system to become unresponsive, leading to a denial of service (DoS).

A moderate-impact denial of service flaw was found in the btrfs file system of the Linux kernel. A local user could trigger a deadlock during file defragmentation: the defragmentation path reserves delayed-allocation (delalloc) metadata space while it still holds dirty and locked folios along with the extent range lock. The writeback and metadata space reclaim paths that must make progress to satisfy that reservation instead block waiting on those locked folios and on the current transaction, creating a circular wait that can leave the system unresponsive, resulting in a denial of service. Only availability is affected; confidentiality and integrity are not impacted (Red Hat CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5, Moderate). The Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 kernel streams are affected, and the fix for these streams has been deferred because this is a moderate-severity local availability issue that requires particular defragmentation-related workload conditions to trigger (the upstream report reproduced it with autodefrag and flushoncommit under heavy filesystem stress); the residual risk is therefore limited to a local user causing the system to become unresponsive. Red Hat Enterprise Linux 6, 7, 8, and 9 (kernel and kernel-rt) and the OpenShift Container Platform RHEL CoreOS images are not affected because the vulnerable code is not present in those versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.