Description
In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: fix deadlock waiting for ticket during data relocation

When performing data relocation on a zoned filesystem, BTRFS can deadlock
in handle_reserve_tickets(). The relocation process is waiting on a space
reservation ticket that can never be fulfilled, because the relocation
itself is the operation responsible for freeing up that space.

Fix this by introducing a new flush state,
BTRFS_RESERVE_FLUSH_ZONED_RELOCATION, specifically for data chunk
allocation during zoned relocation. Like
BTRFS_RESERVE_FLUSH_FREE_SPACE_INODE, this state uses
priority_reclaim_data_space() instead of the normal flushing path, which
avoids re-entering the relocation code and breaking the deadlock cycle.

In btrfs_alloc_data_chunk_ondemand(), select this new flush state when the
inode belongs to a data relocation root on a zoned filesystem.
Published: 2026-08-15
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a deadlock that can occur during data relocation on BTRFS zoned filesystems. When the relocation process waits for a ticket that can never be granted because the relocation itself is responsible for freeing the necessary space, the kernel thread blocks indefinitely. This can lead to a kernel hang or crash, disrupting system availability. The weakness is a concurrency flaw causing a deadlock, which may be categorized under race‑condition weaknesses.

Affected Systems

Any Linux system using the BTRFS zoned feature before the kernel commit that introduces BTRFS_RESERVE_FLUSH_ZONED_RELOCATION is affected. The failure occurs in the handle_reserve_tickets() routine of the BTRFS implementation for zoned filesystems.

Risk and Exploitability

The defect does not allow arbitrary code execution or privilege escalation, but it can cause a denial of service by halting system operations. The CVSS score is 5.5, indicating a medium severity. The EPSS score is < 1%, reflecting a very low yet non-zero probability of exploitation. Automated exploitation would be complex and unlikely. A local attacker with sufficient privileges could trigger the condition by performing data relocation on the zoned BTRFS filesystem. Administrators should treat the risk as high and apply the fix promptly.

Generated by OpenCVE AI on August 22, 2026 at 02:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that incorporates the BTRFS zoned relocation deadlock fix, as referenced by the commits 814c3b4ea3 and f84dbbaa98.
  • If an immediate kernel update is not feasible, consider disabling BTRFS zoned filesystems or avoiding data relocation operations until the patch is applied.
  • If updating or disabling zoned filesystems is not possible, postpone any data relocation tasks and monitor system stability until the patch is applied.

Generated by OpenCVE AI on August 22, 2026 at 02:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-754
CWE-758

Wed, 19 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-833
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate


Sat, 15 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-754
CWE-758

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock waiting for ticket during data relocation When performing data relocation on a zoned filesystem, BTRFS can deadlock in handle_reserve_tickets(). The relocation process is waiting on a space reservation ticket that can never be fulfilled, because the relocation itself is the operation responsible for freeing up that space. Fix this by introducing a new flush state, BTRFS_RESERVE_FLUSH_ZONED_RELOCATION, specifically for data chunk allocation during zoned relocation. Like BTRFS_RESERVE_FLUSH_FREE_SPACE_INODE, this state uses priority_reclaim_data_space() instead of the normal flushing path, which avoids re-entering the relocation code and breaking the deadlock cycle. In btrfs_alloc_data_chunk_ondemand(), select this new flush state when the inode belongs to a data relocation root on a zoned filesystem.
Title btrfs: zoned: fix deadlock waiting for ticket during data relocation
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:17:09.243Z

Reserved: 2026-08-15T05:44:03.884Z

Link: CVE-2026-74319

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:32.333

Modified: 2026-08-17T06:19:26.320

Link: CVE-2026-74319

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74319 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T02:45:03Z

Weaknesses