CVE-2026-74571

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: skip global block reserve accounting for rescue mounts<br /> <br /> [BUG]<br /> Mounting with rescue=ibadroots after corrupting the block group tree<br /> root triggers a NULL pointer dereference:<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000100<br /> RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs]<br /> Call Trace:<br /> fill_dummy_bgs+0xd4/0x120 [btrfs]<br /> open_ctree+0xc6e/0x1ca0 [btrfs]<br /> btrfs_get_tree+0x50d/0xa40 [btrfs]<br /> <br /> The same crash occurs with a corrupted raid stripe tree root, via<br /> btrfs_read_block_groups() instead of fill_dummy_bgs().<br /> <br /> [CAUSE]<br /> With rescue=ibadroots, btrfs_read_roots() allows the mount to continue<br /> when either root cannot be read, leaving the corresponding root pointer<br /> NULL while its on-disk feature bit remains set.<br /> <br /> btrfs_update_global_block_rsv() then dereferences the missing root based<br /> on the feature bit alone.<br /> <br /> [FIX]<br /> Rescue mounts are fully read-only and cannot start transactions, so the<br /> global reserve is never consumed. Under btrfs_is_full_ro(), mark the<br /> reserve as full and return before performing the accounting.<br /> <br /> And since we need to check if the fs is mount fully RO, export<br /> fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.<br /> <br /> [ Squash the fs_is_full_ro() export commit into this one. ]