CVE-2026-74571 btrfs: skip global block reserve accounting for rescue mounts
A local attacker with physical access or mount privileges can cause a kernel crash by mounting a corrupted Btrfs filesystem with rescue options.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-74571?
CVE-2026-74571 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: skip global block reserve accounting for rescue mounts
[BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000100 RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs] Call Trace: fill_dummy_bgs+0xd4/0x120 [btrfs] open_ctree+0xc6e/0x1ca0 [btrfs] btrfs_get_tree+0x50d/0xa40 [btrfs]
The same crash occurs with a corrupted raid stripe tree root, via btrfs_read_block_groups() instead of fill_dummy_bgs().
[CAUSE] With rescue=ibadroots, btrfs_read_roots() allows the mount to continue when either root cannot be read, leaving the corresponding root pointer NULL while its on-disk feature bit remains set.
btrfs_update_global_block_rsv() then dereferences the missing root based on the feature bit alone.
[FIX] Rescue mounts are fully read-only and cannot start transactions, so the global reserve is never consumed. Under btrfs_is_full_ro(), mark the reserve as full and return before performing the accounting.
And since we need to check if the fs is mount fully RO, export fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.
[ Squash the fs_is_full_ro() export commit into this one. ]
Which versions are affected by CVE-2026-74571?
How do I fix CVE-2026-74571?
Apply the vendor's patch.
Is CVE-2026-74571 being exploited?
There is no known exploitation of CVE-2026-74571 in the wild and no public exploit code.
Sources
Also known as AZL-96371, BELL-CVE-2026-74571, DEBIAN-CVE-2026-74571, GHSA-2vh7-793m-f7hf, UBUNTU-CVE-2026-74571.