CVE-2026-53284

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: only release the dirty pages io tree after successful writes<br /> <br /> [WARNING]<br /> With extra warning on dirty extent buffers at umount (aka, the next<br /> patch in the series), test case generic/388 can trigger the following<br /> warning about dirty extent buffers at unmount time:<br /> <br /> BTRFS critical (device dm-2 state E): emergency shutdown<br /> BTRFS error (device dm-2 state E): error while writing out transaction: -30<br /> BTRFS warning (device dm-2 state E): Skipping commit of aborted transaction.<br /> BTRFS error (device dm-2 state EA): Transaction 9 aborted (error -30)<br /> BTRFS: error (device dm-2 state EA) in cleanup_transaction:2068: errno=-30 Readonly filesystem<br /> BTRFS info (device dm-2 state EA): forced readonly<br /> BTRFS info (device dm-2 state EA): last unmount of filesystem 4fbf2e15-f941-49a0-bc7c-716315d2777c<br /> ------------[ cut here ]------------<br /> WARNING: disk-io.c:3311 at invalidate_and_check_btree_folios+0xfd/0x1ca [btrfs], CPU#8: umount/914368<br /> CPU: 8 UID: 0 PID: 914368 Comm: umount Tainted: G OE 7.1.0-rc1-custom+ #372 PREEMPT(full) 2de38db8d1deae71fde295430a0ff3ab98ccf596<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022<br /> RIP: 0010:invalidate_and_check_btree_folios+0xfd/0x1ca [btrfs]<br /> Call Trace:<br /> <br /> close_ctree+0x52e/0x574 [btrfs d2f0b1cd330d1287e7a9919d112eadfc0e914efd]<br /> generic_shutdown_super+0x89/0x1a0<br /> kill_anon_super+0x16/0x40<br /> btrfs_kill_super+0x16/0x20 [btrfs d2f0b1cd330d1287e7a9919d112eadfc0e914efd]<br /> deactivate_locked_super+0x2d/0xb0<br /> cleanup_mnt+0xdc/0x140<br /> task_work_run+0x5a/0xa0<br /> exit_to_user_mode_loop+0x123/0x4b0<br /> do_syscall_64+0x243/0x7c0<br /> entry_SYSCALL_64_after_hwframe+0x4b/0x53<br /> <br /> ---[ end trace 0000000000000000 ]---<br /> BTRFS warning (device dm-2 state EA): unable to release extent buffer 30539776 owner 9 gen 9 refs 2 flags 0x7<br /> BTRFS warning (device dm-2 state EA): unable to release extent buffer 30621696 owner 257 gen 9 refs 2 flags 0x7<br /> BTRFS warning (device dm-2 state EA): unable to release extent buffer 30638080 owner 258 gen 9 refs 2 flags 0x7<br /> BTRFS warning (device dm-2 state EA): unable to release extent buffer 30654464 owner 7 gen 9 refs 2 flags 0x7<br /> BTRFS warning (device dm-2 state EA): unable to release extent buffer 30703616 owner 2 gen 9 refs 2 flags 0x7<br /> BTRFS warning (device dm-2 state EA): unable to release extent buffer 30720000 owner 10 gen 9 refs 2 flags 0x7<br /> BTRFS warning (device dm-2 state EA): unable to release extent buffer 30736384 owner 4 gen 9 refs 2 flags 0x7<br /> BTRFS warning (device dm-2 state EA): unable to release extent buffer 30752768 owner 11 gen 9 refs 2 flags 0x7<br /> <br /> I&amp;#39;m using a stripped down version, which seems to trigger the warning<br /> more reliably:<br /> <br /> _fsstress_pid=""<br /> workload()<br /> {<br /> dmesg -C<br /> mkfs.btrfs -f -K $dev &gt; /dev/null<br /> echo 1 &gt; /sys/kernel/debug/clear_warn_once<br /> mount $dev $mnt<br /> $fsstress -w -n 1024 -p 4 -d $mnt &amp;<br /> _fsstress_pid=$!<br /> sleep 0<br /> $godown $mnt<br /> pkill --echo -PIPE fsstress &gt; /dev/null<br /> wait $_fsstress_pid<br /> unset _fsstress_pid<br /> umount $mnt<br /> <br /> if dmesg | grep -q "WARNING"; then<br /> fail<br /> fi<br /> }<br /> <br /> for (( i = 0; i