CVE-2026-23036

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: release path before iget_failed() in btrfs_read_locked_inode()

In btrfs_read_locked_inode() if we fail to lookup the inode, we jump to

the 'out' label with a path that has a read locked leaf and then we call

iget_failed(). This can result in a ABBA deadlock, since iget_failed()

triggers inode eviction and that causes the release of the delayed inode,

which must lock the delayed inode's mutex, and a task updating a delayed

inode starts by taking the node's mutex and then modifying the inode's

subvolume btree.

Syzbot reported the following lockdep splat for this:

======================================================

WARNING: possible circular locking dependency detected

syzkaller #0 Not tainted

------------------------------------------------------

btrfs-cleaner/8725 is trying to acquire lock:

ffff0000d6826a48 (&delayed_node->mutex){+.+.}-{4:4}, at: __btrfs_release_delayed_node+0xa0/0x9b0 fs

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References