btrfs: zoned: don't clobber the extent buffer when zeroing it out
CVE-2026-90260 · published 17 Sept 2026
How serious is it
- Severity: high, CVSS score 7.1 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-90260?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: aa6313e6ff2bfbf736a2739047bba355d8241584 to < efa5084d08030aa557fdefa3e4a73b2501b7d207, aa6313e6ff2bfbf736a2739047bba355d8241584 to < 92484ad014f2e2b0e0e7bbc1610951e978cf557c, aa6313e6ff2bfbf736a2739047bba355d8241584 to < 98e3747587f9f87f010d8d7e55786216249a94af, aa6313e6ff2bfbf736a2739047bba355d8241584 to < db4b9eefc8ee0bcaeee4d5e6a7313905f6a2fe7c
- Linux Linux: 6.8
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
btrfs: zoned: don't clobber the extent buffer when zeroing it out
On a zoned filesystem a freed-but-still-dirty tree block is written out
as zeros (EXTENT_BUFFER_ZONED_ZEROOUT) only to keep the zone write
pointer advancing. btree_csum_one_bio() implemented this by memzeroing
the extent buffer's own folios before submission.
That destroys the in-memory buffer while it may still be referenced. In
particular btrfs_free_tree_block() can run on it afterwards and reads
the header to add a delayed reference; once the header has been zeroed
it frees bytenr 0 and corrupts the extent tree (the
btrfs_header_bytenr(buf) != 0 ASSERT in btrfs_free_tree_block(), or an
"unable to find ref" abort). It is flaky and reproduces under fsstress,
e.g. generic/461 and generic/013.
Write the zeros to disk from the shared zero page instead and leave the
extent buffer content untouched, so any later reference - including the
delayed reference from btrfs_free_tree_block() - still sees a valid
header. end_bbio_meta_write() now clears writeback on the buffer's own
folios, as the bio no longer carries them.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/efa5084d08030aa557fdefa3e4a73b2501b7d207
- git.kernel.org/stable/c/92484ad014f2e2b0e0e7bbc1610951e978cf557c
- git.kernel.org/stable/c/98e3747587f9f87f010d8d7e55786216249a94af
- git.kernel.org/stable/c/db4b9eefc8ee0bcaeee4d5e6a7313905f6a2fe7c
Merged from CVE List. Last updated 26 Oct 2026. All vulnerabilities · RSS · JSON