CVE-2026-90264: btrfs: always wait for ordered extents to avoid OE races
btrfs: always wait for ordered extents to avoid OE races
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
Modify Btrfs buffered writeback to unconditionally wait for existing ordered extents, including when direct I/O has reverted the file size, to prevent overlapping ordered extents; update lock_and_cleanup_extent_if_need() so it either locks the extents or returns -EAGAIN, removing no-extent-locked handling and the _if_need suffix.
Event History
Frequently Asked Questions
What impact is documented for affected systems?
The reported failure triggers a kernel BUG and Btrfs critical messages when overlapping ordered extents are inserted for the same file range. This can panic the kernel.
How can administrators identify that this issue has occurred?
Check kernel logs for BTRFS critical messages mentioning "overlapping ordered extents" and a panic in insert_ordered_extent or btrfs_alloc_ordered_extent. The example reports errno -17, "Object already exists," for conflicting extents with identical file offsets and byte ranges.
Does the report describe attacker access or a remote exploitation path?
No. The provided information describes a Syzbot-reported ordered-extent race and resulting kernel panic, but does not specify an attacker model, required access level, or remote attack path.