{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74571","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.917Z","datePublished":"2026-08-15T12:28:10.711Z","dateUpdated":"2026-08-17T05:22:00.523Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:22:00.523Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: skip global block reserve accounting for rescue mounts\n\n[BUG]\nMounting with rescue=ibadroots after corrupting the block group tree\nroot triggers a NULL pointer dereference:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000100\n  RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs]\n  Call Trace:\n   fill_dummy_bgs+0xd4/0x120 [btrfs]\n   open_ctree+0xc6e/0x1ca0 [btrfs]\n   btrfs_get_tree+0x50d/0xa40 [btrfs]\n\nThe same crash occurs with a corrupted raid stripe tree root, via\nbtrfs_read_block_groups() instead of fill_dummy_bgs().\n\n[CAUSE]\nWith rescue=ibadroots, btrfs_read_roots() allows the mount to continue\nwhen either root cannot be read, leaving the corresponding root pointer\nNULL while its on-disk feature bit remains set.\n\nbtrfs_update_global_block_rsv() then dereferences the missing root based\non the feature bit alone.\n\n[FIX]\nRescue mounts are fully read-only and cannot start transactions, so the\nglobal reserve is never consumed. Under btrfs_is_full_ro(), mark the\nreserve as full and return before performing the accounting.\n\nAnd since we need to check if the fs is mount fully RO, export\nfs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.\n\n[ Squash the fs_is_full_ro() export commit into this one. ]"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/btrfs/block-rsv.c","fs/btrfs/disk-io.c","fs/btrfs/fs.h"],"versions":[{"version":"8dbfc14fc736eb701089aff09645c3d4ad3decb1","lessThan":"076349e4c8d11f6b58c4549976a513b2b4dc6df2","status":"affected","versionType":"git"},{"version":"8dbfc14fc736eb701089aff09645c3d4ad3decb1","lessThan":"51a0e8399858621442807a26057bcd1cd3ced046","status":"affected","versionType":"git"},{"version":"cbec34d3021d47007a0334c634f7053dbaf93d02","status":"affected","versionType":"git"},{"version":"1e8087589b5cf6fa17adaf57b64cf1656d77dfec","status":"affected","versionType":"git"},{"version":"6.1.43","lessThan":"6.2","status":"affected","versionType":"semver"},{"version":"6.4.8","lessThan":"6.5","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/btrfs/block-rsv.c","fs/btrfs/disk-io.c","fs/btrfs/fs.h"],"versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","status":"unaffected","versionType":"semver"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.43"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/076349e4c8d11f6b58c4549976a513b2b4dc6df2"},{"url":"https://git.kernel.org/stable/c/51a0e8399858621442807a26057bcd1cd3ced046"}],"title":"btrfs: skip global block reserve accounting for rescue mounts","x_generator":{"engine":"bippy-1.2.0"}}}}