PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23157 Linux CVE debrief

A deadlock vulnerability in the Linux kernel's Btrfs filesystem can cause system hangs when memory cgroup dirty limits interact with Btrfs's internal metadata writeback threshold. Affected kernels from 2.6.29 through 6.18.8 (and 6.19-rc1 through rc7) may experience this condition when a cgroup with a small dirty limit (e.g., 16 MB) accumulates dirty Btrfs btree pages that exceed the cgroup limit but remain below Btrfs's fixed 32 MB internal threshold. This prevents writeback from occurring while the memory controller blocks new dirty pages, stalling processes in balance_dirty_pages(). The issue was resolved by removing the strict dirty metadata threshold in btree_writepages() for external callers, allowing the memory controller's view of system state to govern writeback decisions. Kernels 6.18.9 and later, or those with commit b55102826d7d (AS_KERNEL_FILE on btree_inode), are not affected.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-14
Original CVE updated
2026-06-01
Advisory published
2026-02-14
Advisory updated
2026-06-01

Who should care

Organizations running Linux systems with Btrfs and memory cgroups enabled, particularly container hosts or multi-tenant environments with constrained cgroup memory limits.

Technical summary

The Btrfs btree_writepages() function enforced a 32 MB minimum dirty metadata threshold before initiating writeback. When a memory cgroup's dirty limit was lower than this threshold (e.g., 16 MB), dirty btree pages could exceed the cgroup limit without triggering Btrfs writeback. The memory controller then blocked additional dirtying, while Btrfs refused to write back, creating a deadlock. Processes entering balance_dirty_pages() would sleep indefinitely (observed as io_schedule_timeout waits), causing system hangs. The fix removes the strict threshold for external writepage callers, deferring to the memory controller's dirty balancing. Internal callers via btrfs_btree_balance_dirty() retain threshold behavior.

Defensive priority

medium

Recommended defensive actions

  • Apply the appropriate stable kernel patch for your release line (see resource links ref-6 and ref-7).
  • Upgrade to Linux kernel 6.18.9 or later, or a stable release containing the fix.
  • If running containerized workloads with memory cgroups on affected kernels, monitor for processes stuck in D state within balance_dirty_pages() as an indicator of this deadlock.
  • Consider prioritizing patching on systems using Btrfs with memory-constrained cgroups or small dirty limits.

Evidence notes

CVE published 2026-02-14; modified 2026-06-01. CPE indicates affected versions from 2.6.29 through 6.18.8, plus 6.19-rc1 through rc7. Patches available via stable kernel Git. Root cause analysis attributed to Jan Kara in the commit message. CVSS 5.5 (MEDIUM) per NVD.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23157 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23157

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23157 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23157

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0c3666ec188640c20e254011e7adf4464c32ee58

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4357e02cafabe01c2d737ceb4c4c6382fc2ee10a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4e159150a9a56d66d247f4b5510bed46fe58aa1c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/629666d20c7dcd740e193ec0631fdff035b1f7d6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6a8b6242eaa1dd7a0de2d6de6420d10ffe68db90

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bb9be3f713652e330df00f3724c18c7a5469e7ac

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.