CVE-2026-74321

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

In the beginning of the loop, we try to obtain a locked delayed ref head,

if 'locked_ref' is currently NULL, by calling btrfs_select_ref_head(),

which can return an error pointer. If the error pointer is -EAGAIN we do

a continue and go back to the beginning of the loop, which will not try

again to call btrfs_select_ref_head() since 'locked_ref' is no longer

NULL but it's ERR_PTR(-EAGAIN), and then we do:

spin_lock(&locked_ref->lock);

against a ERR_PTR(-EAGAIN) value, generating an invalid pointer

dereference.

Fix this by ensuring that 'locked_ref' is set to NULL when

btrfs_select_ref_head() returns ERR_PTR(-EAGAIN) and incrementing 'count'

as well, to prevent infinite looping. We do this by doing a goto to the

bottom of the loop that already sets 'locked_ref' to NULL and does a

cond_resched(), with an increment to 'count' right before the goto

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References