CVE-2026-23018: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23018 is a circular lock dependency vulnerability in the Linux kernel's btrfs filesystem implementation, classified as a denial-of-service flaw. It affects Linux kernel versions 6.16.9 through 6.17 (exclusive), 6.17.1 through 6.18.6 (exclusive), and 6.19 release candidates (rc1–rc8). The vulnerability was published on January 31, 2026, with patches available in kernel 6.17 and stable backports. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper lock ordering (CWE-667: Improper Locking) in the btrfs_read_locked_inode() function, which calls btrfs_init_file_extent_tree() while holding a read-locked path (leaf) from a subvolume tree. The btrfs_init_file_extent_tree() function may perform a GFP_KERNEL memory allocation, which can trigger the kernel's memory reclaim mechanism (kswapd). This creates a circular lock dependency chain: fs_reclaim → btrfs-tree-00 → &delayed_node->mutex, which lockdep detects and warns about. The deadlock scenario requires a local, low-privileged user to perform filesystem operations on a btrfs volume under memory pressure conditions (Red Hat Bugzilla).

Successful exploitation causes a system hang or kernel panic, resulting in a complete denial of service for the affected host. The vulnerability is triggered when the kernel's memory reclaim process (kswapd) deadlocks with btrfs filesystem operations, preventing normal system operation. There is no confidentiality or integrity impact — the vulnerability is limited to availability, affecting any system using btrfs as a primary or secondary filesystem under memory pressure (Red Hat Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability requires local access with low privileges and is most likely to manifest under high memory pressure conditions, limiting its practical exploitability. The EPSS score is 0.018% (0.000180), indicating a very low probability of exploitation in the near term. CVE-2026-23018 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory).

• Logs: Kernel log (dmesg or /var/log/kern.log) entries containing WARNING: possible circular locking dependency detected referencing btrfs_read_locked_inode, btrfs_init_file_extent_tree, or fs_reclaim.
• Logs: Lockdep splat messages referencing the lock chain &delayed_node->mutex → btrfs-tree-00 → fs_reclaim in kernel logs.
• System Behavior: Unexpected system hangs or kernel panics on hosts using btrfs filesystems, particularly during periods of high memory utilization or active swap usage.
• Process: kswapd process appearing stuck or unresponsive in process listings (ps aux) on btrfs-backed systems under memory pressure.

The fix is available in Linux kernel version 6.17 and later, as well as in stable backport patches for kernels 6.16.9+ (fixed before 6.17) and 6.17.1+ (fixed in 6.18.6). Specific upstream patch commits are 8731f2c50b0b1d2b58ed5b9671ef2c4bdc2f8347 and 92a5590851144f034adc51fee55e6878ccac716e on git.kernel.org. Red Hat has tracked the issue via Bugzilla (Bug 2435638). Until patching is complete, administrators should monitor btrfs systems for kernel panics or hangs under memory pressure and consider implementing automatic restart policies as a temporary mitigation (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).