CVE-2026-74321 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
In the beginning of the loop, we try to obtain a locked delayed ref head, if 'locked_ref' is currently NULL, by calling btrfs_select_ref_head(), which can return an error pointer. If the error pointer is -EAGAIN we do a continue and go back to the beginning of the loop, which will not try again to call btrfs_select_ref_head() since 'locked_ref' is no longer NULL but it's ERR_PTR(-EAGAIN), and then we do:
spin_lock(&locked_ref->lock);
against a ERR_PTR(-EAGAIN) value, generating an invalid pointer dereference.
Fix this by ensuring that 'locked_ref' is set to NULL when btrfs_select_ref_head() returns ERR_PTR(-EAGAIN) and incrementing 'count' as well, to prevent infinite looping. We do this by doing a goto to the bottom of the loop that already sets 'locked_ref' to NULL and does a cond_resched(), with an increment to 'count' right before the goto. These measures were in place before the refactoring in commit 0110a4c43451 ("btrfs: refactor __btrfs_run_delayed_refs loop") but were unintentionally lost afterwards.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical invalid pointer dereference flaw within the btrfs file system implementation of the Linux kernel, specifically in the __btrfs_run_delayed_refs() function. This issue manifests as a result of improper error handling during the delayed reference processing loop, where the kernel attempts to acquire and lock delayed reference heads for processing. The vulnerability arises from a regression introduced by a refactoring commit that inadvertently removed essential safeguards, creating a condition where error pointers are not properly handled before being dereferenced.
The technical implementation flaw occurs when the function attempts to obtain a locked delayed reference head through the btrfs_select_ref_head() call, which may return an error pointer indicating temporary unavailability. When this error pointer with value -EAGAIN is returned and not properly checked, the code continues execution without resetting the locked_ref variable to NULL. This creates a scenario where subsequent code attempts to acquire a spin lock on what should be a valid reference head but instead contains an error indicator, leading to immediate system crashes or undefined behavior.
This vulnerability directly maps to CWE-476 which defines "NULL Pointer Dereference" and represents a classic race condition in kernel space programming. The operational impact of this flaw is severe as it can cause system instability, potential data corruption, and complete system crashes when the btrfs file system attempts to process delayed references under normal operating conditions. The vulnerability affects any Linux system utilizing btrfs file systems with delayed reference processing enabled, making it particularly concerning for enterprise environments where such file systems are commonly deployed.
The fix implemented addresses this by reintroducing proper error handling mechanisms that ensure locked_ref is reset to NULL when btrfs_select_ref_head() returns ERR_PTR(-EAGAIN), combined with appropriate loop counter incrementation to prevent infinite looping scenarios. This solution employs a goto statement to efficiently handle the error condition and reset necessary variables, restoring the protective measures that were accidentally removed during the earlier refactoring process. The mitigation strategy aligns with ATT&CK technique T1490 which covers "Inhibit System Recovery" through kernel-level vulnerabilities, demonstrating the importance of proper error handling in system-critical components.
The vulnerability demonstrates how seemingly minor refactoring changes can introduce critical security flaws in kernel code, emphasizing the need for comprehensive testing and validation of all code modifications. The fix maintains the original intent of the loop while ensuring that error conditions are properly handled through established kernel programming patterns, preventing the invalid pointer dereference from occurring during normal system operation. This represents a standard defensive programming approach where error states are explicitly checked and managed before attempting operations on potentially invalid data structures.