CVE-2026-90260

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: don't clobber the extent buffer when zeroing it out

On a zoned filesystem a freed-but-still-dirty tree block is written out

as zeros (EXTENT_BUFFER_ZONED_ZEROOUT) only to keep the zone write

pointer advancing. btree_csum_one_bio() implemented this by memzeroing

the extent buffer's own folios before submission.

That destroys the in-memory buffer while it may still be referenced. In

particular btrfs_free_tree_block() can run on it afterwards and reads

the header to add a delayed reference; once the header has been zeroed

it frees bytenr 0 and corrupts the extent tree (the

btrfs_header_bytenr(buf) != 0 ASSERT in btrfs_free_tree_block(), or an

"unable to find ref" abort). It is flaky and reproduces under fsstress,

e.g. generic/461 and generic/013.

Write the zeros to disk from the shared zero page instead and leave the

extent buffer content untouched, so any later reference - including the

delayed referenc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References