CVE-2026-74571 Linux CVE debrief

Who should care

Linux system administrators and users who utilize the btrfs file system, especially those managing Linux kernel versions 6.1.43 to 6.5, should assess exposure and apply patches or verify system configurations for rescue mounts to prevent potential crashes and data inconsistencies. Security teams should review compensating controls and monitor for related incidents.

Why it matters

A vulnerability in the Linux kernel's btrfs module allows for a NULL pointer dereference when mounting a file system with corrupted block group tree root or raid stripe tree root and the rescue=ibadroots option.

• Verify system configurations for rescue mounts to prevent potential crashes
• Assess exposure and apply patches for Linux kernel versions 6.1.43 to 6.5

Technical summary

The Linux kernel's btrfs module is vulnerable to a NULL pointer dereference when mounting a file system with corrupted block group tree root or raid stripe tree root and the rescue=ibadroots option. The issue arises because btrfs_read_roots() allows the mount to continue with NULL root pointers when either root is unreadable. The fix skips global block reserve accounting under btrfs_is_full_ro(), marking the reserve as full and returning before accounting, as rescue mounts are read-only and do not consume the global reserve.

Defensive priority

Assess exposure and apply patches for Linux kernel versions 6.1.43 to 6.5, and verify system configurations for rescue mounts.

Recommended defensive actions

• Assess exposure by reviewing system configurations for rescue mounts
• Apply patches for Linux kernel versions 6.1.43 to 6.5
• Verify system configurations for rescue mounts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and Linux kernel source code indicate a NULL pointer dereference vulnerability in the btrfs module. The issue arises when mounting a file system with a corrupted block group tree root or raid stripe tree root and the rescue=ibadroots option.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.