UBUNTU-CVE-2026-74571: Null Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts [BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000100 RIP: 0010:btrfsupdateglobalblockrsv+0x9d/0x1c0 [btrfs] Call Trace: filldummybgs+0xd4/0x120 [btrfs] openctree+0xc6e/0x1ca0 [btrfs] btrfsgettree+0x50d/0xa40 [btrfs] The same crash occurs with a corrupted raid stripe tree root, via btrfsreadblockgroups() instead of filldummybgs(). [CAUSE] With rescue=ibadroots, btrfsreadroots() allows the mount to continue when either root cannot be read, leaving the corresponding root pointer NULL while its on-disk feature bit remains set. btrfsupdateglobalblockrsv() then dereferences the missing root based on the feature bit alone. [FIX] Rescue mounts are fully read-only and cannot start transactions, so the global reserve is never consumed. Under btrfsisfullro(), mark the reserve as full and return before performing the accounting. And since we need to check if the fs is mount fully RO, export fsisfullro() as btrfsisfullro(), and move it to fs.h. [ Squash the fsisfullro() export commit into this one. ]