Description
In the Linux kernel, the following vulnerability has been resolved:

btrfs: skip global block reserve accounting for rescue mounts

[BUG]
Mounting with rescue=ibadroots after corrupting the block group tree
root triggers a NULL pointer dereference:

BUG: kernel NULL pointer dereference, address: 0000000000000100
RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs]
Call Trace:
fill_dummy_bgs+0xd4/0x120 [btrfs]
open_ctree+0xc6e/0x1ca0 [btrfs]
btrfs_get_tree+0x50d/0xa40 [btrfs]

The same crash occurs with a corrupted raid stripe tree root, via
btrfs_read_block_groups() instead of fill_dummy_bgs().

[CAUSE]
With rescue=ibadroots, btrfs_read_roots() allows the mount to continue
when either root cannot be read, leaving the corresponding root pointer
NULL while its on-disk feature bit remains set.

btrfs_update_global_block_rsv() then dereferences the missing root based
on the feature bit alone.

[FIX]
Rescue mounts are fully read-only and cannot start transactions, so the
global reserve is never consumed. Under btrfs_is_full_ro(), mark the
reserve as full and return before performing the accounting.

And since we need to check if the fs is mount fully RO, export
fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.

[ Squash the fs_is_full_ro() export commit into this one. ]
Published: 2026-08-15
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A NULL pointer dereference (CWE-476) in the btrfs filesystem causes the kernel to crash when mounting with rescue=ibadroots after the block group tree root has been corrupted. The bug is triggered by btrfs_update_global_block_rsv attempting to account for a missing root, leading to a crash that interrupts the operating system. The impact is a denial‑of‑service condition, allowing an attacker who can mount the filesystem to bring the host down, but it does not provide arbitrary code execution or privileged escalation.

Affected Systems

This issue affects all Linux kernel builds that include the btrfs filesystem and are running a version that lacks the btrfs_is_full_ro guard. The vendor information lists Linux: Linux; an explicit affected version range has not been supplied, so any unpatched kernel that can mount a resilient btrfs filesystem is potentially vulnerable.

Risk and Exploitability

The CVSS score is 5.5, indicating a medium severity, and the EPSS score is less than 1%, implying a very low exploitation probability. The vulnerability requires privilege to mount filesystems with rescue=ibadroots, which typically implies root or administrative access. Once mounted on a corrupted filesystem, the null dereference causes an immediate kernel panic, effectively denying service. The issue is not listed in the CISA KEV catalog, indicating no confirmed exploits in the wild at the time of this analysis. Nonetheless, the crash severity suggests operators should patch promptly.

Generated by OpenCVE AI on August 21, 2026 at 19:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that contains the btrfs_is_full_ro fix
  • Avoid using the rescue=ibadroots mount option on filesystems that may be corrupted, or ensure the block group tree is intact before mounting
  • Restrict the use of rescue=ibadroots to administrative users only, for example by enforcing access control policies or SELinux rules

Generated by OpenCVE AI on August 21, 2026 at 19:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Sat, 15 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts [BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000100 RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs] Call Trace: fill_dummy_bgs+0xd4/0x120 [btrfs] open_ctree+0xc6e/0x1ca0 [btrfs] btrfs_get_tree+0x50d/0xa40 [btrfs] The same crash occurs with a corrupted raid stripe tree root, via btrfs_read_block_groups() instead of fill_dummy_bgs(). [CAUSE] With rescue=ibadroots, btrfs_read_roots() allows the mount to continue when either root cannot be read, leaving the corresponding root pointer NULL while its on-disk feature bit remains set. btrfs_update_global_block_rsv() then dereferences the missing root based on the feature bit alone. [FIX] Rescue mounts are fully read-only and cannot start transactions, so the global reserve is never consumed. Under btrfs_is_full_ro(), mark the reserve as full and return before performing the accounting. And since we need to check if the fs is mount fully RO, export fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h. [ Squash the fs_is_full_ro() export commit into this one. ]
Title btrfs: skip global block reserve accounting for rescue mounts
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:22:00.523Z

Reserved: 2026-08-15T05:44:03.917Z

Link: CVE-2026-74571

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T13:18:02.733

Modified: 2026-08-17T06:19:55.417

Link: CVE-2026-74571

cve-icon Redhat

Severity : Low

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74571 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T20:00:13Z

Weaknesses