PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-74321 Linux CVE debrief

A vulnerability in the Linux kernel's btrfs module could allow an attacker to cause a denial of service. The vulnerability exists in the __btrfs_run_delayed_refs() function, where an invalid pointer dereference can occur due to a refactoring error. This could potentially lead to a system crash or instability. The issue arises from a logic error in handling delayed references, which could be triggered by crafted file system operations. Linux kernel developers and users of Linux systems utilizing the btrfs file system should assess exposure and prioritize remediation.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-10-16
Advisory published
2026-08-15
Advisory updated
2026-10-16

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems that utilize the btrfs file system should assess exposure and prioritize remediation. This includes reviewing and applying patches, monitoring system stability, and verifying the integrity of the btrfs file system.

Why it matters

The vulnerability in the Linux kernel's btrfs module could lead to a denial of service. Linux kernel developers, maintainers, and users of Linux systems that utilize the btrfs file system should assess exposure and prioritize remediation.

  • Denial of service due to system crash or instability
  • Potential for exploitation requires verification from official sources
  • Remediation priority is high for systems utilizing the btrfs file system
  • Verification of affected versions and exposure is necessary

Technical summary

The vulnerability exists in the __btrfs_run_delayed_refs() function, where an invalid pointer dereference can occur due to a refactoring error. The fix ensures that 'locked_ref' is set to NULL when btrfs_select_ref_head() returns ERR_PTR(-EAGAIN) and increments 'count' to prevent infinite looping. This issue was introduced in a refactoring commit and was fixed by adding a conditional check for the error pointer. The vulnerability could be triggered by crafted file system operations, potentially leading to a system crash or instability.

Defensive priority

High

Recommended defensive actions

  • Review and apply the patch to the Linux kernel
  • Ensure that the Linux kernel is updated to a version that includes the fix
  • Monitor system stability and logs for potential issues related to the btrfs module
  • Verify the integrity of the btrfs file system after applying the patch
  • Check for any signs of exploitation or anomalous behavior in system logs
  • Perform a thorough review of system configurations and exposure to potential attacks
  • Consider implementing compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The vulnerability was introduced in a refactoring commit and was fixed by ensuring that 'locked_ref' is set to NULL when btrfs_select_ref_head() returns ERR_PTR(-EAGAIN) and incrementing 'count' to prevent infinite looping.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-74321 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-74321

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-74321 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74321

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74321.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c372ca227e16bace86f1df1fa4ae6849e2fcfa28

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a71143590ce9764dbcb47617647592ff8b4d48bc

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/65770111a2d47c2b15e20b2ba92bb12198f289d4

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/015dc4a1e0c2cba551d4620eba13d26d5081dc34

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ba9fa2ff5981589bb49094d3358c339b37c47f53

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3b15d02be05e74321adb1e0ae0cb4ccfba7c6cb1

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9faa6b69ad73f03c7bde53e07d75a28822dc9a1a

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.