CVE-2024-26726
Linux Kernel vulnerability analysis and mitigation

Overview

CVE-2024-26726 affects the Linux kernel's BTRFS filesystem implementation. The vulnerability was discovered during CI testing and involves a bug in handling extent maps for free space inodes during write errors. The issue was identified and fixed in early 2024, with the initial commit being made by Josef Bacik on January 31, 2024 (Kernel Commit).

Technical details

The vulnerability occurs when writing out the free space cache fails and the system attempts to write it again. During the second attempt, btrfs_get_extent() is called on the inode to get the extent mapping. Due to searching the commit root to avoid deadlocking with the tree for new block groups, nothing is found and EXTENT_MAP_HOLE is returned. The issue arises because the first failed write attempt drops the extent mapping, which is normal for regular files but problematic for free space cache inodes where the extent map must always be correct (Kernel Commit).

Impact

When triggered, this vulnerability results in a kernel panic with an assertion failure: 'block_start != EXTENT_MAP_HOLE' in fs/btrfs/extent_io.c:1385. This leads to system instability and potential denial of service (Kernel Commit).

Exploitability

The vulnerability can be triggered during normal filesystem operations when writing to the free space cache fails. It was reproducible through error injection testing in the filesystem's CI environment (Kernel Commit).

Mitigation and workarounds

The issue has been fixed by modifying the code to skip dropping the extent map range for failed ranges specifically in the case of free space inodes. The fix has been implemented in the Linux kernel and backported to stable kernel versions 4.14 and newer (Kernel Commit).

Additional resources


SourceThis report was generated using AI

Related Linux Kernel vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-80904MEDIUM5.9
  • Linux Kernel logoLinux Kernel
  • linux-hwe-7.0
NoYesSep 04, 2026
CVE-2026-80905MEDIUM5.5
  • Linux Kernel logoLinux Kernel
  • linux-nvidia-7.0
NoYesSep 04, 2026
CVE-2026-80913MEDIUM4.4
  • Linux Kernel logoLinux Kernel
  • linux-intel-iotg-5.15
NoYesSep 04, 2026
CVE-2026-80912MEDIUM4.4
  • Linux Kernel logoLinux Kernel
  • linux-gcp-fips
NoYesSep 04, 2026
CVE-2026-80906NONEN/A
  • Linux Kernel logoLinux Kernel
  • linux-azure-7.0
NoYesSep 04, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management