Linux Kernel up to 7.1.7/7.2-rc5 btrfs fs.h btrfs_update_global_block_rsv null pointer dereference

Summaryinfo

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 7.1.7/7.2-rc5. This affects the function btrfs_update_global_block_rsv of the file fs.h of the component btrfs. The manipulation results in null pointer dereference. This vulnerability is reported as CVE-2026-74571. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 7.1.7/7.2-rc5. Affected is the function btrfs_update_global_block_rsv of the file fs.h of the component btrfs. The manipulation with an unknown input leads to a null pointer dereference vulnerability. CWE is classifying the issue as CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. This is going to have an impact on availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts [BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000100 RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs] Call Trace: fill_dummy_bgs+0xd4/0x120 [btrfs] open_ctree+0xc6e/0x1ca0 [btrfs] btrfs_get_tree+0x50d/0xa40 [btrfs] The same crash occurs with a corrupted raid stripe tree root, via btrfs_read_block_groups() instead of fill_dummy_bgs(). [CAUSE] With rescue=ibadroots, btrfs_read_roots() allows the mount to continue when either root cannot be read, leaving the corresponding root pointer NULL while its on-disk feature bit remains set. btrfs_update_global_block_rsv() then dereferences the missing root based on the feature bit alone. [FIX] Rescue mounts are fully read-only and cannot start transactions, so the global reserve is never consumed. Under btrfs_is_full_ro(), mark the reserve as full and return before performing the accounting. And since we need to check if the fs is mount fully RO, export fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h. [ Squash the fs_is_full_ro() export commit into this one. ]

The advisory is available at git.kernel.org. This vulnerability is traded as CVE-2026-74571 since 08/15/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are required for exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 7.1.8 or 7.2-rc6 eliminates this vulnerability. Applying the patch 076349e4c8d11f6b58c4549976a513b2b4dc6df2/51a0e8399858621442807a26057bcd1cd3ced046 is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.2-rc1
• 7.2-rc2
• 7.2-rc3
• 7.2-rc4
• 7.2-rc5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion