UBUNTU-CVE-2026-90265: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: btrfs: defrag: fix deadlock between defrag and delalloc space reservation While running fsstress with autodefrag and flushoncommit, hit a deadlock due to the fact that defrag reserves delalloc space while it's holding dirty and locked folios, besides the extent range lock. The stack traces are the following: [958.624] task:kworker/u50:3 state:D stack:0 pid:20365 tgid:20365 ppid:2 taskflags:0x4208060 flags:0x00080000 [958.626] Workqueue: eventsunbound btrfsasyncreclaimmetadataspace [btrfs] [958.627] Call Trace: [958.628] <TASK> [958.628] schedule+0x4be/0x10f0 [958.629] ? preemptcountadd+0x69/0xa0 [958.630] schedule+0x26/0xd0 [958.631] waitcurrenttrans+0x102/0x160 [btrfs] [958.632] ? pfxautoremovewakefunction+0x10/0x10 [958.633] starttransaction+0x374/0x900 [btrfs] [958.634] btrfscommitcurrenttransaction+0x1d/0x70 [btrfs] [958.635] flushspace+0xca/0x5e0 [btrfs] [958.636] ? rawspinunlock+0x15/0x30 [958.637] ? btrfsreduceallocprofile+0x8c/0x190 [btrfs] [958.639] ? rawspinunlock+0x15/0x30 [958.640] ? calcavailablefreespace.isra.0+0x6f/0x110 [btrfs] [958.641] doasyncreclaimmetadataspace+0x84/0x190 [btrfs] [958.642] btrfsasyncreclaimmetadataspace+0x64/0x80 [btrfs] [958.644] processonework+0x19d/0x3a0 [958.644] workerthread+0x1c4/0x330 [958.645] ? pfxworkerthread+0x10/0x10 [958.646] kthread+0xfc/0x130 [958.647] ? pfxkthread+0x10/0x10 [958.648] retfromfork+0x1f7/0x2c0 [958.648] ? pfxkthread+0x10/0x10 [958.649] retfromforkasm+0x1a/0x30 [958.650] </TASK> [958.651] task:kworker/u49:7 state:D stack:0 pid:52990 tgid:52990 ppid:2 taskflags:0x4208060 flags:0x00080000 [958.653] Workqueue: writeback wbworkfn (flush-btrfs-334) [958.655] Call Trace: [958.655] <TASK> [958.656] schedule+0x4be/0x10f0 [958.657] ? blkflushplug+0xe9/0x140 [958.658] schedule+0x26/0xd0 [958.658] ioschedule+0x42/0x70 [958.659] foliowaitbitcommon+0x12b/0x330 [958.660] ? foliowaitbitcommon+0x100/0x330 [958.662] ? pfxwakepagefunction+0x10/0x10 [958.663] extentwritecachepages+0x599/0x830 [btrfs] [958.664] ? acpifwnodegetreferenceargs+0x1fa/0x270 [958.665] btrfswritepages+0x77/0x130 [btrfs] [958.666] ? pfxendbbiodatawrite+0x10/0x10 [btrfs] [958.667] dowritepages+0xc6/0x160 [958.668] writebacksingleinode+0x42/0x310 [958.669] writebacksbinodes+0x231/0x570 [958.670] wbwriteback+0x8a/0x340 [958.671] wbworkfn+0xbf/0x450 [958.672] ? finishtaskswitch.isra.0+0xc1/0x350 [958.673] processonework+0x19d/0x3a0 [958.673] workerthread+0x1c4/0x330 [958.674] ? pfxworkerthread+0x10/0x10 [958.675] kthread+0xfc/0x130 [958.676] ? pfxkthread+0x10/0x10 [958.676] retfromfork+0x1f7/0x2c0 [958.677] ? pfxkthread+0x10/0x10 [958.678] retfromforkasm+0x1a/0x30 [958.679] </TASK> [958.679] task:btrfs-cleaner state:D stack:0 pid:296750 tgid:296750 ppid:2 taskflags:0x208040 flags:0x00080000 [958.681] Call Trace: [958.682] <TASK> [958.682] schedule+0x4be/0x10f0 [958.683] schedule+0x26/0xd0 [958.684] handlereserveticket+0x1b9/0x2c0 [btrfs] [958.685] ? pfxautoremovewakefunction+0x10/0x10 [958.686] reservebytes+0x283/0x4c0 [btrfs] [958.687] btrfsreservemetadatabytes+0x18/0xb0 [btrfs] [958.688] btrfsdelallocreservemetadata+0x121/0x320 [btrfs] [958.690] btrfsdelallocreservespace+0x46/0xb0 [btrfs] [958.691] btrfsdefragfile+0x903/0x1110 [btrfs] [958.692] btrfsrundefraginodes+0x334/0x430 [btrfs] [958.694] cleanerkthread+0x97/0x1c0 [btrfs] [958.694] ? pfxcleanerkthread+0x10/0x10 [btrfs] [958.696] kthread+0xfc/0x130 [958.696] ? pfxkthread+0x10/0x10 [958.697] ret ---truncated---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Is this remotely exploitable?
No. The vector is local and requires low privileges; no user interaction is required.
Which systems are most likely to encounter the issue?
The deadlock was observed on Btrfs while running fsstress with autodefrag and flushoncommit. Systems using Btrfs with defragmentation and delayed-allocation space reservation activity are the relevant exposure area.
What is the expected impact if triggered?
The issue can cause a deadlock in Btrfs space-reclamation and transaction-commit activity, resulting in an availability impact. The supplied severity vector indicates no confidentiality or integrity impact.
Which Ubuntu kernel package families are listed as affected?
The listed packages are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.