https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:39:48 +0000 https://vulnerability.circl.lu/vuln/cve-2026-53122 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>btrfs: fix deadlock between reflink and transaction commit when using flushoncommit</p> <p>When using the flushoncommit mount option, we can have a deadlock between a transaction commit and a reflink operation that copied an inline extent to an offset beyond the current i_size of the destination node.</p> <p>The deadlock happens like this:</p> <p>1) Task A clones an inline extent from inode X to an offset of inode Y that is beyond Y&#39;s current i_size. This means we copied the inline extent&#39;s data to a folio of inode Y that is beyond its EOF, using a call to copy_inline_to_page();</p> <p>2) Task B starts a transaction commit and calls btrfs_start_delalloc_flush() to flush delalloc;</p> <p>3) The delalloc flushing sees the new dirty folio of inode Y and when it attempts to flush it, it ends up at extent_writepage() and sees that the offset of the folio is beyond the i_size of inode Y, so it attempts to invalidate the folio by calling folio_invalidate(), which ends up at btrfs&#39; folio invalidate callback - btrfs_invalidate_folio(). There it tries to lock the folio&#39;s range in inode Y&#39;s extent io tree, but it blocks since it&#39;s currently locked by task A - during a reflink we lock the inodes and the source and destination ranges after flushing all delalloc and waiting for ordered extent completion - after that we don&#39;t expect to have dirty folios in the ranges, the exception is if we have to copy an inl…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>btrfs: fix deadlock between reflink and transaction commit when using flushoncommit</p> <p>When using the flushoncommit mount option, we can have a deadlock between a transaction commit and a reflink operation that copied an inline extent to an offset beyond the current i_size of the destination node.</p> <p>The deadlock happens like this:</p> <p>1) Task A clones an inline extent from inode X to an offset of inode Y that is beyond Y&#39;s current i_size. This means we copied the inline extent&#39;s data to a folio of inode Y that is beyond its EOF, using a call to copy_inline_to_page();</p> <p>2) Task B starts a transaction commit and calls btrfs_start_delalloc_flush() to flush delalloc;</p> <p>3) The delalloc flushing sees the new dirty folio of inode Y and when it attempts to flush it, it ends up at extent_writepage() and sees that the offset of the folio is beyond the i_size of inode Y, so it attempts to invalidate the folio by calling folio_invalidate(), which ends up at btrfs&#39; folio invalidate callback - btrfs_invalidate_folio(). There it tries to lock the folio&#39;s range in inode Y&#39;s extent io tree, but it blocks since it&#39;s currently locked by task A - during a reflink we lock the inodes and the source and destination ranges after flushing all delalloc and waiting for ordered extent completion - after that we don&#39;t expect to have dirty folios in the ranges, the exception is if we have to copy an inl…</p> https://vulnerability.circl.lu/vuln/cve-2026-53122