CVE-2026-93255: btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock
In the Linux kernel, the following vulnerability has been resolved:
btrfs: make sure EXTENTBUFFERREADING is cleared under refslock
[FALSE ALERTS] There is a bug report that the warning inside invalidateandcheckbtreefolios() got triggered during btrfs/298:
BTRFS info (device sdd): first mount of filesystem f9bf732a-a19b-44b9-99a7-614ddff168e2 BTRFS info (device sdd): using crc32c checksum algorithm BTRFS error (device sdd): failed to find fsid cb2fdb42-b638-4f2f-badd-4127467ba674 when attempting to open seed devices BTRFS error (device sdd): failed to read chunk tree: -2 ------------[ cut here ]------------ WARNING: disk-io.c:3342 at invalidateandcheckbtreefolios+0x260/0x3c0 [btrfs], CPU#4: mount/125993 CPU: 4 UID: 0 PID: 125993 Comm: mount Tainted: G W OE 7.1.0-rc7-custom+ #1 PREEMPT(full) Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025 Call trace: invalidateandcheckbtreefolios+0x260/0x3c0 [btrfs] (P) openctree+0x1f50/0x23b0 [btrfs] btrfsgettree+0x89c/0xc48 [btrfs] vfsgettree+0x30/0x110 vfscmdcreate+0x58/0xe8 arm64sysfsconfig+0x39c/0x518 invokesyscall.constprop.0+0x48/0x120 el0svccommon.constprop.0+0x40/0xe8 doel0svc+0x24/0x38 el0svc+0x50/0x310 el0t64synchandler+0xa0/0xe8 el0t64sync+0x198/0x1a0 ---[ end trace 0000000000000000 ]--- BTRFS warning (device sdd): unable to release extent buffer 365985792 owner 3 gen 17 refs 3 flags 0x5
[CAUSE] In that invalidateandcheckbtreefolios() we wait for the eb to finish its read, then check if it's only held by us and the btree inode.
If not, then do a warning as it may be still held, and could cause problems.
But there is a small window where the check can lead to false alerts:
Thread A (Read endio) | Thread B (Unmount) ----------------------------------+------------------------------------- endbbiometaread() | | The eb has one extra ref held | | by the reader, and has | | EXTENTBUFFERREADING flag set | invalidateandcheckbtreefolios() | | | |- clearextentbufferreading() | | | | |- waitonbitio(); | | | The EXTENTBUFFERREADING flag is | | | cleared | | |- if (refcountread(eb->refs) > 2) | | The eb is held by the read, us | | and btree inode, thus it | | will trigger the warning |- freeextentbuffer() |
[FIX] Introduce a helper, freeextentbufferclearreading().
If the new parameter, @clearreading, is set, we will hold the spinlock at the beginning of freeextentbufferclearreading() to make sure the EXTENTBUFFERREADING flag is cleared inside the same critical section of decreasing refs.
Now freeextentbuffer() will just call freeextentbufferclearreading() with @clearreading set to false, so no behavior change.
But for endbbiometaread(), it will not clearextentbufferreading() directly, but pass @clearreading as true.
Then inside invalidateandcheckbtreefolios(), hold the refslock before reading refs. So that we eliminate the race window completely.
Affected Software
Event History
Frequently Asked Questions
Is this issue considered an exploitable security vulnerability?
The provided description labels this report as “[FALSE ALERTS].” It documents a kernel warning rather than an attacker-controlled exploit or security impact.
What symptom was observed?
A warning in invalidate_and_check_btree_folios() was triggered while mounting a Btrfs filesystem. The logged mount also failed to find the filesystem ID for seed devices and failed to read the chunk tree.
What scenario is documented as triggering the warning?
The warning was reported during the btrfs/298 test, in a QEMU KVM virtual machine running a custom 7.1.0-rc7 kernel. The supplied data does not establish that ordinary Btrfs mounts or default configurations trigger it.
What change addresses the reported warning?
The described fix ensures EXTENT_BUFFER_READING is cleared while holding refs_lock. Two stable kernel commit references are provided for the resolution.