CVE-2026-74318

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix deadlock cloning inline extent when using flushoncommit

In commit b48c980b6a7e ("btrfs: fix deadlock between reflink and

transaction commit when using flushoncommit") a deadlock was fixed

between reflinks and transaction commits when the fs is mounted with the

flushoncommit option. This happened when we had to copy an inline extent's

data to the destination file. However the issue was fixed only for the

case where the destination offset is 0, it missed the case when the offset

is greater than zero.

Fix this by ensuring we get i_size update whenever we copied an inline

extent's data into the destination file.

Syzbot reported this with the following trace:

INFO: task kworker/u8:3:57 blocked for more than 143 seconds.

Not tainted syzkaller #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:kworker/u8:3 state:D stack:21600 pid:57 tgid:57 ppid:2

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References