CVE-2026-93255

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock<br /> <br /> [FALSE ALERTS]<br /> There is a bug report that the warning inside<br /> invalidate_and_check_btree_folios() got triggered during btrfs/298:<br /> <br /> BTRFS info (device sdd): first mount of filesystem f9bf732a-a19b-44b9-99a7-614ddff168e2<br /> BTRFS info (device sdd): using crc32c checksum algorithm<br /> BTRFS error (device sdd): failed to find fsid cb2fdb42-b638-4f2f-badd-4127467ba674 when attempting to open seed devices<br /> BTRFS error (device sdd): failed to read chunk tree: -2<br /> ------------[ cut here ]------------<br /> WARNING: disk-io.c:3342 at invalidate_and_check_btree_folios+0x260/0x3c0 [btrfs], CPU#4: mount/125993<br /> CPU: 4 UID: 0 PID: 125993 Comm: mount Tainted: G W OE 7.1.0-rc7-custom+ #1 PREEMPT(full)<br /> Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025<br /> Call trace:<br /> invalidate_and_check_btree_folios+0x260/0x3c0 [btrfs] (P)<br /> open_ctree+0x1f50/0x23b0 [btrfs]<br /> btrfs_get_tree+0x89c/0xc48 [btrfs]<br /> vfs_get_tree+0x30/0x110<br /> vfs_cmd_create+0x58/0xe8<br /> __arm64_sys_fsconfig+0x39c/0x518<br /> invoke_syscall.constprop.0+0x48/0x120<br /> el0_svc_common.constprop.0+0x40/0xe8<br /> do_el0_svc+0x24/0x38<br /> el0_svc+0x50/0x310<br /> el0t_64_sync_handler+0xa0/0xe8<br /> el0t_64_sync+0x198/0x1a0<br /> ---[ end trace 0000000000000000 ]---<br /> BTRFS warning (device sdd): unable to release extent buffer 365985792 owner 3 gen 17 refs 3 flags 0x5<br /> <br /> [CAUSE]<br /> In that invalidate_and_check_btree_folios() we wait for the eb to finish<br /> its read, then check if it&amp;#39;s only held by us and the btree inode.<br /> <br /> If not, then do a warning as it may be still held, and could cause<br /> problems.<br /> <br /> But there is a small window where the check can lead to false alerts:<br /> <br /> Thread A (Read endio) | Thread B (Unmount)<br /> ----------------------------------+-------------------------------------<br /> end_bbio_meta_read() |<br /> | The eb has one extra ref held |<br /> | by the reader, and has |<br /> | EXTENT_BUFFER_READING flag set | invalidate_and_check_btree_folios()<br /> | | |<br /> |- clear_extent_buffer_reading() | |<br /> | | |- wait_on_bit_io();<br /> | | | The EXTENT_BUFFER_READING flag is<br /> | | | cleared<br /> | | |- if (refcount_read(eb-&gt;refs) &gt; 2)<br /> | | The eb is held by the read, us<br /> | | and btree inode, thus it<br /> | | will trigger the warning<br /> |- free_extent_buffer() |<br /> <br /> [FIX]<br /> Introduce a helper, free_extent_buffer_clear_reading().<br /> <br /> If the new parameter, @clear_reading, is set, we will hold the spinlock<br /> at the beginning of free_extent_buffer_clear_reading() to make sure the<br /> EXTENT_BUFFER_READING flag is cleared inside the same critical section<br /> of decreasing refs.<br /> <br /> Now free_extent_buffer() will just call<br /> free_extent_buffer_clear_reading() with @clear_reading set to false, so<br /> no behavior change.<br /> <br /> But for end_bbio_meta_read(), it will not clear_extent_buffer_reading()<br /> directly, but pass @clear_reading as true.<br /> <br /> Then inside invalidate_and_check_btree_folios(), hold the refs_lock<br /> before reading refs.<br /> So that we eliminate the race window completely.