CVE-2026-64164 - Vulnerability Details

- btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()

The trace event btrfs_sync_file() is called in an atomic context (all trace
events are) and its call to dput(), which is needed due to the call to
dget_parent(), can sleep, triggering a kernel splat.

This can be reproduced by enabling the trace event and running btrfs/056
from fstests for example. The splat shown in dmesg is the following:

[53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970
[53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io
[53.988] preempt_count: 2, expected: 0
[53.967] RCU nest depth: 0, expected: 0
[53.943] Preemption disabled at:
[53.944] [<0000000000000000>] 0x0
[54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full)
[54.070] Tainted: [W]=WARN
[54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
[54.072] Call Trace:
[54.074] <TASK>
[54.076] dump_stack_lvl+0x56/0x80
[54.079] __might_resched.cold+0xd6/0x10f
[54.072] dput.part.0+0x24/0x110
[54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs]
[54.089] btrfs_sync_file+0x1ed/0x530 [btrfs]
[54.087] ? __handle_mm_fault+0x8ae/0xed0
[54.089] btrfs_do_write_iter+0x172/0x210 [btrfs]
[54.091] vfs_write+0x21f/0x450
[54.094] __x64_sys_pwrite64+0x8d/0xc0
[54.096] ? do_user_addr_fault+0x20c/0x670
[54.099] do_syscall_64+0x60/0xf20
[54.092] ? clear_bhb_loop+0x60/0xb0
[54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e

So stop using dget_parent() and dput() and access the parent dentry
directly as dentry->d_parent. This is also what ext4 is doing in
its equivalent trace event ext4_sync_file_enter().

Published: 2026-07-19

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug occurs when the btrfs tracepoint btrfs_sync_file() is enabled. The trace event runs in an atomic context, but it calls dput() which may sleep because it follows a dget_parent() call. This sleeping function in an atomic context triggers a kernel panic, evident as a BUG entry in dmesg. The resulting crash causes a loss of system availability and potentially data loss if the kernel reboots without detach.

Affected Systems

Linux kernel installations that include the btrfs filesystem and have tracing enabled are vulnerable. The issue exists in all kernel versions prior to the patch that replaces dget_parent() and dput() with direct access to dentry->d_parent. The affected products span any distribution using the standard Linux kernel and deploying btrfs.

Risk and Exploitability

The EPSS score is under 1 %, indicating a low likelihood of exploitation. The bug is not listed in the CISA KEV catalog and no CVSS score is published. An attacker would need to enable the tracepoint and induce a btrfs write operation, a capability that is generally limited to privileged or local users. Successful exploitation results only in a kernel panic, which is a denial‑of‑service condition; it does not provide information disclosure or privilege escalation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4a7bab35fad5251c8cb738161152578cd83b6b9c`	affected	< d78b0a80eac36879ef5478707135c446920e134b
`520e8b4bcf872a534a7bf61ccf880047642df296`	affected	< 4361954f0e158af0530caa1e57f12b531be4658f
`e252db8ca2a01f82d472091f35d549b313278636`	affected	< 6279992c9ba2774901c9d4dd4a481162e2534714
`c09a7446aab5773f38d6abb25fce99b8e1dfbc97`	affected	< 26b2290baaf6da6add0f782a100766e686a33f4f
`32372781d664a9b03c40343e96c29d0a6139f97d`	affected	< 12a0487945c09760a5968d9333383014ea294117
`2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a`	affected	< c32a7e0e3c73c1c0768556a56bd78de9f7b83780
`a85b46db143fda5869e7d8df8f258ccef5fa1719`	affected	< 0a96d9a85cd2240481297156b9bb72e10b7a8036
`a85b46db143fda5869e7d8df8f258ccef5fa1719`	affected	< c73370c677646e86fc4b1780fb07027bdf847375
`d110d7cdb045715c0b45b0dfd974525bb38f653d`	affected	—
`6.6.136`	affected	< 6.6.142
`6.12.83`	affected	< 6.12.92
`6.18.24`	affected	< 6.18.34
`6.19.14`	affected	< 6.20

Linux

affected

Version	Status	Constraints
`7.0`	affected	—
`0`	unaffected	< 7.0
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4a7bab35fad5251c8cb738161152578cd83b6b9c,d78b0a80eac36879ef5478707135c446920e134b)`	affected	code_commit	—
`[520e8b4bcf872a534a7bf61ccf880047642df296,4361954f0e158af0530caa1e57f12b531be4658f)`	affected	code_commit	—
`[e252db8ca2a01f82d472091f35d549b313278636,6279992c9ba2774901c9d4dd4a481162e2534714)`	affected	code_commit	—
`[c09a7446aab5773f38d6abb25fce99b8e1dfbc97,26b2290baaf6da6add0f782a100766e686a33f4f)`	affected	code_commit	—
`[32372781d664a9b03c40343e96c29d0a6139f97d,12a0487945c09760a5968d9333383014ea294117)`	affected	code_commit	—
`[2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a,c32a7e0e3c73c1c0768556a56bd78de9f7b83780)`	affected	code_commit	—
`[a85b46db143fda5869e7d8df8f258ccef5fa1719,0a96d9a85cd2240481297156b9bb72e10b7a8036)`	affected	code_commit	—
`[a85b46db143fda5869e7d8df8f258ccef5fa1719,c73370c677646e86fc4b1780fb07027bdf847375)`	affected	code_commit	—
`d110d7cdb045715c0b45b0dfd974525bb38f653d`	affected	code_commit	—
`[6.6.136,6.6.142)`	affected	semver	—
`[6.12.83,6.12.92)`	affected	semver	—
`[6.18.24,6.18.34)`	affected	semver	—
`[6.19.14,6.20)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`7.0`	affected	generic	—
`[0,7.0)`	unaffected	generic	—
`[6.6.142,6.6.*]`	unaffected	generic	—
`[6.12.92,6.12.*]`	unaffected	generic	—
`[6.18.34,6.18.*]`	unaffected	generic	—
`[7.0.11,7.0.*]`	unaffected	generic	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that contains the fix removing the sleeping call from btrfs_sync_file().
If upgrading is not possible, disable the btrfs_sync_file tracepoint by writing 0 to /sys/kernel/debug/tracing/events/btrfs/btrfs_sync_file/enable.
Ensure that only authorized users have write access to the tracing control files and consider restricting tracepoint usage at the system level.

Generated by OpenCVE AI on July 30, 2026 at 20:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00165.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0a96d9a85cd2240481297156b9bb72e10b7a8036
https://git.kernel.org/stable/c/12a0487945c09760a5968d9333383014ea294117
https://git.kernel.org/stable/c/26b2290baaf6da6add0f782a100766e686a33f4f
https://git.kernel.org/stable/c/4361954f0e158af0530caa1e57f12b531be4658f
https://git.kernel.org/stable/c/6279992c9ba2774901c9d4dd4a481162e2534714
https://git.kernel.org/stable/c/c32a7e0e3c73c1c0768556a56bd78de9f7b83780
https://git.kernel.org/stable/c/c73370c677646e86fc4b1780fb07027bdf847375
https://git.kernel.org/stable/c/d78b0a80eac36879ef5478707135c446920e134b
https://lore.kernel.org/linux-cve-announce/2026071934-CVE-2026-64164-a963@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64164
https://www.cve.org/CVERecord?id=CVE-2026-64164

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-663
References		https://lore.kernel.org/linux-cve-announce/2026071934-CVE-2026-64164-a963@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64164 https://www.cve.org/CVERecord?id=CVE-2026-64164

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter().
Title		btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0a96d9a85cd2240481297156b9bb72e10b7a8036 https://git.kernel.org/stable/c/12a0487945c09760a5968d9333383014ea294117 https://git.kernel.org/stable/c/26b2290baaf6da6add0f782a100766e686a33f4f https://git.kernel.org/stable/c/4361954f0e158af0530caa1e57f12b531be4658f https://git.kernel.org/stable/c/6279992c9ba2774901c9d4dd4a481162e2534714 https://git.kernel.org/stable/c/c32a7e0e3c73c1c0768556a56bd78de9f7b83780 https://git.kernel.org/stable/c/c73370c677646e86fc4b1780fb07027bdf847375 https://git.kernel.org/stable/c/d78b0a80eac36879ef5478707135c446920e134b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:49.894Z

Updated: 2026-07-19T15:40:49.894Z

Reserved: 2026-07-19T07:54:57.038Z

Link: CVE-2026-64164

Vulnrichment

No data.

NVD

No data.

Redhat

Severity :

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64164 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:15:05Z

Weaknesses

CWE-663
Use of a Non-reentrant Function in a Concurrent Context

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object