CVE-2026-74365

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

nvdimm/btt: Handle preemption in BTT lane acquisition

BTT lanes serialize access to per-lane metadata and workspace state

during BTT I/O. The btt-check unit test reports data mismatches during

BTT writes due to a race in lane acquisition that can lead to silent

data corruption.

The existing lane model uses a spinlock together with a per-CPU

recursion count. That recursion model stopped being valid after BTT

lanes became preemptible: another task can run on the same CPU,

observe a non-zero recursion count, bypass locking, and use the same

lane concurrently.

BTT lanes are also held across arena_write_bytes() calls. That path

reaches nsio_rw_bytes(), which flushes writes with nvdimm_flush().

Some provider flush callbacks can sleep, making a spinlock the wrong

primitive for the lane lifetime.

Replace the spinlock-based recursion model with a dynamically

allocated per-lane mutex array and take the lane lock

uncondition

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References