CVE-2026-74572

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: zoned: fix deadlock between metadata writeback and transaction commit<br /> <br /> When writing out metadata extent buffers in a zoned filesystem,<br /> btree_writepages() holds fs_info-&gt;zoned_meta_io_lock across the whole<br /> writeback loop, including the call to btrfs_check_meta_write_pointer() -&gt;<br /> check_bg_is_active().<br /> <br /> For the tree-log block group, check_bg_is_active() may fail to activate<br /> the zone and fall back to btrfs_zone_finish_one_bg() to free an active<br /> zone. That path waits for the running transaction to commit while still<br /> holding zoned_meta_io_lock, but the committer needs that same lock to<br /> write out the tree extents, so the two tasks deadlock:<br /> <br /> Task A (kworker, metadata writeback) Task B (fsstress, transaction commit)<br /> ------------------------------------ -------------------------------------<br /> wb_workfn() btrfs_commit_transaction(T)<br /> btree_writepages() btrfs_write_and_wait_transaction()<br /> btrfs_zoned_meta_io_lock() btrfs_write_marked_extents()<br /> btrfs_check_meta_write_pointer() btree_writepages()<br /> check_bg_is_active() [treelog_bg] btrfs_zoned_meta_io_lock()<br /> btrfs_zone_finish_one_bg() <br /> do_zone_finish()<br /> btrfs_inc_block_group_ro()<br /> btrfs_wait_for_commit()<br /> <br /> <br /> The sibling branch in check_bg_is_active() already drops zoned_meta_io_lock<br /> around do_zone_finish() for this exact reason. Do the same in the tree-log<br /> branch: release the lock around btrfs_zone_finish_one_bg() and re-acquire<br /> it afterwards. The lock only protects fs_info-&gt;active_{meta,system}_bg,<br /> which this branch does not touch, and ctx-&gt;zoned_bg keeps a reference to<br /> the block group across the unlock, so nothing is lost while the lock<br /> is dropped.<br /> <br /> This hang occasionally reproduces with fstests generic/475 on a zoned<br /> btrfs filesystem.