CVE-2026-23018

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: release path before initializing extent tree in btrfs_read_locked_inode()

In btrfs_read_locked_inode() we are calling btrfs_init_file_extent_tree()

while holding a path with a read locked leaf from a subvolume tree, and

btrfs_init_file_extent_tree() may do a GFP_KERNEL allocation, which can

trigger reclaim.

This can create a circular lock dependency which lockdep warns about with

the following splat:

[6.1433] ======================================================

[6.1574] WARNING: possible circular locking dependency detected

[6.1583] 6.18.0+ #4 Tainted: G U

[6.1591] ------------------------------------------------------

[6.1599] kswapd0/117 is trying to acquire lock:

[6.1606] ffff8d9b6333c5b8 (&delayed_node->mutex){+.+.}-{3:3}, at: __btrfs_release_delayed_node.part.0+0x39/0x2f0

[6.1625]

but task is already holding lock:

[6.1633] ffffffffa4ab8ce0 (fs_reclaim){+.+.}-{0:

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References