Description
In the Linux kernel, the following vulnerability has been resolved:

btrfs: zstd: fix lost wakeup when waiting for a workspace

A writer can sleep forever in zstd_get_workspace() even though a workspace
is free. When zstd_alloc_workspace() fails, the task is queued on
zwsm->wait and schedules unconditionally, never re-testing the pool.
zstd_put_workspace() publishes the workspace and then calls cond_wake_up(),
which only wakes when a sleeper is already visible, so a workspace returned
between the failed allocation and prepare_to_wait() wakes nobody. The
window is wide: zstd_alloc_workspace() goes through kvmalloc() and may
enter reclaim.

Only a max level workspace triggers the wakeup and one is deliberately kept
allocated as the fallback every waiter waits for, so once its wakeup is
lost the writer stays in TASK_UNINTERRUPTIBLE until some other task happens
to return one. Re-check the pool after prepare_to_wait() has published the
waiter, and use the workspace if one turned up.
Published: 2026-09-25
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

In the Linux kernel’s btrfs module, the zstd compression subsystem can lose a wakeup signal when it fails to allocate a workspace. A writer that waits for a free workspace may enter an infinite sleep in the TASK_UNINTERRUPTIBLE state, preventing the thread from running and causing system resources to be tied up. This flaw does not provide a local or remote code execution path, but it can lead to a denial of service by stalling processes that rely on zstd compression workspaces.

Affected Systems

The issue affects all Linux kernel releases that include the btrfs file system with zstd compression support. It applies broadly to all Linux distributions that ship the original kernel code before the fix was merged. No specific version list is provided, so any kernel in the affected series is potentially vulnerable.

Risk and Exploitability

The vulnerability cannot be triggered remotely; it requires a local user or an attacker with local code execution privileges to invoke btrfs operations that cause workspace allocation. The CVSS score is not disclosed, EPSS data is unavailable, and the flaw is not in the CISA KEV catalog, indicating a lower likelihood of widespread exploitation. However, within a local environment, the bug can result in hung processes and reduced system availability, so the risk is considered moderate for systems that rely heavily on btrfs zstd compression.

Generated by OpenCVE AI on September 25, 2026 at 15:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the btrfs zstd workspace wake‑up fix.
  • If an immediate kernel upgrade is not feasible, limit or disable btrfs zstd compression operations until the patch can be applied.
  • After applying the update, reboot the system to ensure all previous hung threads are cleared

Generated by OpenCVE AI on September 25, 2026 at 15:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-632

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: btrfs: zstd: fix lost wakeup when waiting for a workspace A writer can sleep forever in zstd_get_workspace() even though a workspace is free. When zstd_alloc_workspace() fails, the task is queued on zwsm->wait and schedules unconditionally, never re-testing the pool. zstd_put_workspace() publishes the workspace and then calls cond_wake_up(), which only wakes when a sleeper is already visible, so a workspace returned between the failed allocation and prepare_to_wait() wakes nobody. The window is wide: zstd_alloc_workspace() goes through kvmalloc() and may enter reclaim. Only a max level workspace triggers the wakeup and one is deliberately kept allocated as the fallback every waiter waits for, so once its wakeup is lost the writer stays in TASK_UNINTERRUPTIBLE until some other task happens to return one. Re-check the pool after prepare_to_wait() has published the waiter, and use the workspace if one turned up.
Title btrfs: zstd: fix lost wakeup when waiting for a workspace
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T10:24:16.892Z

Reserved: 2026-09-25T10:19:56.074Z

Link: CVE-2026-98079

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:37.307

Modified: 2026-09-25T11:17:37.307

Link: CVE-2026-98079

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T15:45:19Z

Weaknesses