{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-23036 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-23036 is a vulnerability in Linux, published on 31 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-23036 and fix it if it is affected.\n\nWhat it is: CVE-2026-23036 is a vulnerability in Linux, published on 31 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-23036 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-23036/ (Markdown: https://insights.sbomify.com/CVE-2026-23036/index.md)","id":"CVE-2026-23036","markdown":"https://insights.sbomify.com/CVE-2026-23036/index.md","name":"CVE-2026-23036","record":{"aliases":["BELL-CVE-2026-23036","DEBIAN-CVE-2026-23036","GHSA-v7cw-956x-792r","UBUNTU-CVE-2026-23036"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A race condition in the Linux kernel's Btrfs filesystem can cause a deadlock, leading to a denial of service.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: release path before iget_failed() in btrfs_read_locked_inode()\n\nIn btrfs_read_locked_inode() if we fail to lookup the inode, we jump to\nthe 'out' label with a path that has a read locked leaf and then we call\niget_failed(). This can result in a ABBA deadlock, since iget_failed()\ntriggers inode eviction and that causes the release of the delayed inode,\nwhich must lock the delayed inode's mutex, and a task updating a delayed\ninode starts by taking the node's mutex and then modifying the inode's\nsubvolume btree.\n\nSyzbot reported the following lockdep splat for this:\n\n   ======================================================\n   WARNING: possible circular locking dependency detected\n   syzkaller #0 Not tainted\n   ------------------------------------------------------\n   btrfs-cleaner/8725 is trying to acquire lock:\n   ffff0000d6826a48 (\u0026delayed_node-\u003emutex){+.+.}-{4:4}, at: __btrfs_release_delayed_node+0xa0/0x9b0 fs/btrfs/delayed-inode.c:290\n\n   but task is already holding lock:\n   ffff0000dbeba878 (btrfs-tree-00){++++}-{4:4}, at: btrfs_tree_read_lock_nested+0x44/0x2ec fs/btrfs/locking.c:145\n\n   which lock already depends on the new lock.\n\n   the existing dependency chain (in reverse order) is:\n\n   -\u003e #1 (btrfs-tree-00){++++}-{4:4}:\n          __lock_release kernel/locking/lockdep.c:5574 [inline]\n          lock_release+0x198/0x39c kernel/locking/lockdep.c:5889\n          up_read+0x24/0x3c kernel/locking/rwsem.c:1632\n          btrfs_tree_read_unlock+0xdc/0x298 fs/btrfs/locking.c:169\n          btrfs_tree_unlock_rw fs/btrfs/locking.h:218 [inline]\n          btrfs_search_slot+0xa6c/0x223c fs/btrfs/ctree.c:2133\n          btrfs_lookup_inode+0xd8/0x38c fs/btrfs/inode-item.c:395\n          __btrfs_update_delayed_inode+0x124/0xed0 fs/btrfs/delayed-inode.c:1032\n          btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1118 [inline]\n          __btrfs_commit_inode_delayed_items+0x15f8/0x1748 fs/btrfs/delayed-inode.c:1141\n          __btrfs_run_delayed_items+0x1ac/0x514 fs/btrfs/delayed-inode.c:1176\n          btrfs_run_delayed_items_nr+0x28/0x38 fs/btrfs/delayed-inode.c:1219\n          flush_space+0x26c/0xb68 fs/btrfs/space-info.c:828\n          do_async_reclaim_metadata_space+0x110/0x364 fs/btrfs/space-info.c:1158\n          btrfs_async_reclaim_metadata_space+0x90/0xd8 fs/btrfs/space-info.c:1226\n          process_one_work+0x7e8/0x155c kernel/workqueue.c:3263\n          process_scheduled_works kernel/workqueue.c:3346 [inline]\n          worker_thread+0x958/0xed8 kernel/workqueue.c:3427\n          kthread+0x5fc/0x75c kernel/kthread.c:463\n          ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844\n\n   -\u003e #0 (\u0026delayed_node-\u003emutex){+.+.}-{4:4}:\n          check_prev_add kernel/locking/lockdep.c:3165 [inline]\n          check_prevs_add kernel/locking/lockdep.c:3284 [inline]\n          validate_chain kernel/locking/lockdep.c:3908 [inline]\n          __lock_acquire+0x1774/0x30a4 kernel/locking/lockdep.c:5237\n          lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5868\n          __mutex_lock_common+0x1d0/0x2678 kernel/locking/mutex.c:598\n          __mutex_lock kernel/locking/mutex.c:760 [inline]\n          mutex_lock_nested+0x2c/0x38 kernel/locking/mutex.c:812\n          __btrfs_release_delayed_node+0xa0/0x9b0 fs/btrfs/delayed-inode.c:290\n          btrfs_release_delayed_node fs/btrfs/delayed-inode.c:315 [inline]\n          btrfs_remove_delayed_node+0x68/0x84 fs/btrfs/delayed-inode.c:1326\n          btrfs_evict_inode+0x578/0xe28 fs/btrfs/inode.c:5587\n          evict+0x414/0x928 fs/inode.c:810\n          iput_final fs/inode.c:1914 [inline]\n          iput+0x95c/0xad4 fs/inode.c:1966\n          iget_failed+0xec/0x134 fs/bad_inode.c:248\n          btrfs_read_locked_inode+0xe1c/0x1234 fs/btrfs/inode.c:4101\n          btrfs_iget+0x1b0/0x264 fs/btrfs/inode.c:5837\n          btrfs_run_defrag_inode fs/btrfs/defrag.c:237 [inline]\n          btrfs_run_defrag_inodes+0x520/0xdc4 fs/btrf\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"btrfs: release path before iget_failed() in btrfs_read_locked_inode()","id":"CVE-2026-23036","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"can: etas_es58x: allow partial RX URB allocation to succeed","id":"CVE-2026-23037"},"packages":[],"prev":{"headline":"net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv","id":"CVE-2026-23035"},"products":["Linux"],"published":"2026-01-31","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A race condition in the Linux kernel's Btrfs filesystem can cause a deadlock, leading to a denial of service.","url":"https://insights.sbomify.com/CVE-2026-23036/"}