CVE-2026-53122: Linux btrfs Deadlock with Reflink and flushoncommit

Technical summary

The vulnerability is a deadlock between btrfs transaction commit and reflink operations under flushoncommit. The sequence occurs when: (1) a reflink task copies an inline extent to a destination inode at an offset beyond its i_size via copy_inline_to_page(), creating a dirty folio; (2) a concurrent transaction commit calls btrfs_start_delalloc_flush() which triggers extent_writepage(); (3) the writepage handler sees the folio is beyond EOF and calls folio_invalidate(), invoking btrfs_invalidate_folio() which attempts to lock the extent; (4) the extent lock is held by the reflink task, which then tries to start a new transaction and blocks on TRANS_STATE_COMMIT_START. The result is circular wait: reflink waits for commit, commit waits for extent lock held by reflink. Syzbot confirmed this with kernel hang traces showing tasks stuck in wait_extent_bit and transaction state checks.

Business impact

This vulnerability enables a denial-of-service attack via local system access. An unprivileged user with filesystem access on a btrfs volume mounted with flushoncommit can trigger the deadlock, freezing critical processes and making the system unresponsive. This directly impacts availability of services relying on that filesystem. Affected organizations running btrfs with flushoncommit (a non-default option often used to ensure data durability in specific workloads) face unexpected system hangs. While data confidentiality and integrity are not directly compromised, system unavailability can cascade into broader service disruption.

Affected systems

The vulnerability affects Linux kernel systems using the btrfs filesystem with the flushoncommit mount option enabled. Any distribution or system deploying btrfs with this specific mount flag is potentially vulnerable. Note that flushoncommit is not the default btrfs mount mode, so systems using standard btrfs configurations are not at risk. Affected versions are those prior to the patch that resolves the deadlock condition; verify against the specific Linux distribution and kernel version advisories for affected and patched versions.

Exploitability

Exploitability is straightforward for local attackers with filesystem access. The attack requires only user-level privileges (not root) and can be triggered through reflink operations combined with concurrent filesystem writes. No special tools or exploit code are needed—an attacker can craft reflink operations and writes to induce the deadlock. The vulnerability is easily reproducible as evidenced by Syzbot's detection, meaning attack reliability is high. However, exploitation requires filesystem-level access and the specific mount option to be enabled, limiting exposure to systems where those conditions exist.

Remediation

Apply the kernel patch that resolves the deadlock by properly handling extent locking during reflink operations when dealing with inline extents beyond the destination file's i_size. The fix prevents the race by ensuring extent locks are not held in a way that conflicts with transaction commit serialization. Organizations should: (1) identify systems running btrfs with flushoncommit; (2) update to a patched kernel version (verify version numbers against distribution advisories); (3) test in staging before production rollout to ensure stability.

Patch guidance

Patches are available in updated Linux kernel releases. To remediate: (1) check your current kernel version with 'uname -r'; (2) consult your Linux distribution's security advisory for CVE-2026-53122 to identify patched versions; (3) apply the kernel update through your distribution's package manager (apt, yum, etc.); (4) reboot to activate the patched kernel. For distributions providing backported fixes, patches may be available for multiple stable kernel series. Test the update in a non-production environment first, particularly if btrfs with flushoncommit is critical to your workload.

Detection guidance

Monitor for hung or blocked kernel tasks using 'dmesg' for blocked task warnings mentioning btrfs operations, specifically btrfs_invalidate_folio or wait_extent_bit. System-level indicators include high load with no apparent CPU usage, processes stuck in 'D' (uninterruptible) state shown by 'ps', and filesystem I/O stalls. Log analysis should flag task hang detector warnings over 120+ seconds for kernel workers on btrfs volumes. In production, enable kernel task watchdog and monitor hung_task_timeout_secs alerts. Correlate hangs with reflink operations (cp --reflink or similar) on btrfs volumes mounted with flushoncommit to identify exploitation attempts.

Why prioritize this

Despite a MEDIUM CVSS score, this vulnerability warrants prompt attention because: (1) availability impact is complete denial-of-service via system hang, affecting all services on the filesystem; (2) exploitability is trivial, requiring only local access and standard operations; (3) the condition is easily reproducible, as demonstrated by Syzbot; (4) however, it requires a non-default mount option (flushoncommit), limiting blast radius. Organizations using btrfs with flushoncommit should prioritize patching; others may defer but should eventually apply the update. The vulnerability does not enable privilege escalation or data theft, limiting severity relative to other kernel flaws.

Risk score, explained

The CVSS 5.5 MEDIUM score reflects: Attack Vector=Local (no network), Access Complexity=Low (easy trigger), Privileges Required=Low (unprivileged user can trigger), User Interaction=None, Scope=Unchanged (impact limited to one system), Confidentiality=None, Integrity=None, Availability=High (complete DoS). The score is calibrated to denial-of-service severity with local-only attack scope. However, context matters: organizations not using flushoncommit face zero risk; those using it face significant availability risk. The reproducibility and ease of exploitation increase practical severity despite the moderate CVSS rating.

Frequently asked questions