CVE-2026-53122

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix deadlock between reflink and transaction commit when using flushoncommit

When using the flushoncommit mount option, we can have a deadlock between

a transaction commit and a reflink operation that copied an inline extent

to an offset beyond the current i_size of the destination node.

The deadlock happens like this:

1) Task A clones an inline extent from inode X to an offset of inode Y

that is beyond Y's current i_size. This means we copied the inline

extent's data to a folio of inode Y that is beyond its EOF, using a

call to copy_inline_to_page();

2) Task B starts a transaction commit and calls

btrfs_start_delalloc_flush() to flush delalloc;

3) The delalloc flushing sees the new dirty folio of inode Y and when it

attempts to flush it, it ends up at extent_writepage() and sees that

the offset of the folio is beyond the i_size of inode Y, so it attempts

to invalidate the folio by cal

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References