Description
In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: fix deadlock between metadata writeback and transaction commit

When writing out metadata extent buffers in a zoned filesystem,
btree_writepages() holds fs_info->zoned_meta_io_lock across the whole
writeback loop, including the call to btrfs_check_meta_write_pointer() ->
check_bg_is_active().

For the tree-log block group, check_bg_is_active() may fail to activate
the zone and fall back to btrfs_zone_finish_one_bg() to free an active
zone. That path waits for the running transaction to commit while still
holding zoned_meta_io_lock, but the committer needs that same lock to
write out the tree extents, so the two tasks deadlock:

Task A (kworker, metadata writeback) Task B (fsstress, transaction commit)
------------------------------------ -------------------------------------
wb_workfn() btrfs_commit_transaction(T)
btree_writepages() btrfs_write_and_wait_transaction()
btrfs_zoned_meta_io_lock() btrfs_write_marked_extents()
btrfs_check_meta_write_pointer() btree_writepages()
check_bg_is_active() [treelog_bg] btrfs_zoned_meta_io_lock()
btrfs_zone_finish_one_bg() <blocks on zoned_meta_io_lock,
btrfs_zone_finish() held by Task A>
do_zone_finish()
btrfs_inc_block_group_ro()
btrfs_wait_for_commit()
<blocks waiting for commit
of transaction T, done by
Task B>

The sibling branch in check_bg_is_active() already drops zoned_meta_io_lock
around do_zone_finish() for this exact reason. Do the same in the tree-log
branch: release the lock around btrfs_zone_finish_one_bg() and re-acquire
it afterwards. The lock only protects fs_info->active_{meta,system}_bg,
which this branch does not touch, and ctx->zoned_bg keeps a reference to
the block group across the unlock, so nothing is lost while the lock
is dropped.

This hang occasionally reproduces with fstests generic/475 on a zoned
btrfs filesystem.
Published: 2026-08-15
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The btrfs zoned filesystem suffered a deadlock between metadata writeback and transaction commit. During the writeback loop the guard lock "zoned_meta_io_lock" was held across a call that could block on a transaction commit, while the commit path also required the same lock. The resulting circular wait caused the system to hang in certain workloads, such as those exercised by fstests generic/475, effectively denying service to the affected system. This issue stems from an improper lock release path, a classic concurrency flaw categorized by CWE-667 and CWE-674.

Affected Systems

Any Linux kernel that implements btrfs with zoned mode, from the generic kernel repository before the safeguard was merged. The specific kernel release containing the patch is not enumerated in the provided data; it is present in the recent mainline after commit 18577e77c2c8adaadf1f7c6e9bcd1c0b14e5dcdd. All distributions shipping an unpatched kernel or a kernel that still enables zoned btrfs are therefore impacted.

Risk and Exploitability

The vulnerability lacks a CVSS score and EPSS entry, and it is not listed in CISA KEV. The risk is therefore primarily operational: a system administrator could observe a hang or unresponsiveness whenever metadata intensive operations trigger a transaction commit on a zoned btrfs volume. The likely attack vector is internal; an adversary with the ability to create or manipulate large metadata workloads on a zoned btrfs filesystem could trigger the deadlock. Since the bug is a kernel-level resource contention issue and not a privilege escalation or information leakage flaw, exploitation would not require elevated privileges beyond those normally needed to interact with the filesystem.

Generated by OpenCVE AI on August 15, 2026 at 14:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a release that includes the btrfs zoned deadlock fix (or apply the patch from commit 18577e77c2c8adaadf1f7c6e9bcd1c0b14e5dcdd).
  • If an immediate upgrade is infeasible, avoid using zoned mode on btrfs volumes; consider remounting or reformatting to non‑zoned mode until the patch is applied.
  • Closely monitor kernel logs for btrfs deadlock messages and ensure any high‑metadata‑write workloads are throttled until a patch is in place.

Generated by OpenCVE AI on August 15, 2026 at 14:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 15 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-667
CWE-674

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock between metadata writeback and transaction commit When writing out metadata extent buffers in a zoned filesystem, btree_writepages() holds fs_info->zoned_meta_io_lock across the whole writeback loop, including the call to btrfs_check_meta_write_pointer() -> check_bg_is_active(). For the tree-log block group, check_bg_is_active() may fail to activate the zone and fall back to btrfs_zone_finish_one_bg() to free an active zone. That path waits for the running transaction to commit while still holding zoned_meta_io_lock, but the committer needs that same lock to write out the tree extents, so the two tasks deadlock: Task A (kworker, metadata writeback) Task B (fsstress, transaction commit) ------------------------------------ ------------------------------------- wb_workfn() btrfs_commit_transaction(T) btree_writepages() btrfs_write_and_wait_transaction() btrfs_zoned_meta_io_lock() btrfs_write_marked_extents() btrfs_check_meta_write_pointer() btree_writepages() check_bg_is_active() [treelog_bg] btrfs_zoned_meta_io_lock() btrfs_zone_finish_one_bg() <blocks on zoned_meta_io_lock, btrfs_zone_finish() held by Task A> do_zone_finish() btrfs_inc_block_group_ro() btrfs_wait_for_commit() <blocks waiting for commit of transaction T, done by Task B> The sibling branch in check_bg_is_active() already drops zoned_meta_io_lock around do_zone_finish() for this exact reason. Do the same in the tree-log branch: release the lock around btrfs_zone_finish_one_bg() and re-acquire it afterwards. The lock only protects fs_info->active_{meta,system}_bg, which this branch does not touch, and ctx->zoned_bg keeps a reference to the block group across the unlock, so nothing is lost while the lock is dropped. This hang occasionally reproduces with fstests generic/475 on a zoned btrfs filesystem.
Title btrfs: zoned: fix deadlock between metadata writeback and transaction commit
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T12:28:11.328Z

Reserved: 2026-08-15T05:44:03.917Z

Link: CVE-2026-74572

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T13:18:02.837

Modified: 2026-08-15T13:18:02.837

Link: CVE-2026-74572

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T15:00:04Z

Weaknesses