CVE-2026-23036: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23036 is a Linux kernel vulnerability in the Btrfs filesystem subsystem, specifically a locking issue in btrfs_read_locked_inode() where a path with a read-locked leaf is not released before calling iget_failed(). This can result in an ABBA deadlock (circular locking dependency) between the Btrfs tree lock and the delayed inode mutex. The vulnerability was published on January 31, 2026, and affects the Linux kernel's Btrfs implementation. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Bugzilla, Red Hat CVE).

The root cause is a missing path release in the btrfs_read_locked_inode() function (CWE classification consistent with improper locking/resource management). When an inode lookup fails, execution jumps to the out label while still holding a read lock on a Btrfs tree leaf; the subsequent call to iget_failed() triggers inode eviction, which attempts to acquire the delayed inode's mutex. Concurrently, a task updating a delayed inode holds that mutex and then tries to acquire the Btrfs tree lock — creating a circular dependency (ABBA deadlock) detected by the kernel's lockdep subsystem. Syzbot reported the lockdep splat, tracing the deadlock chain through __btrfs_release_delayed_node, btrfs_evict_inode, iget_failed, and btrfs_read_locked_inode (Red Hat Bugzilla).

Successful exploitation causes a denial-of-service condition on affected Linux systems running Btrfs filesystems, with high availability impact. There is no confidentiality or integrity compromise — the vulnerability cannot be used to access or modify data. A local attacker with low privileges could trigger the deadlock, potentially hanging or crashing kernel threads involved in Btrfs operations such as defragmentation, inode eviction, or metadata reclaim (Red Hat Bugzilla, Red Hat CVE).

A patch is available upstream in the Linux kernel, fixing the issue by releasing the Btrfs path before calling iget_failed() in btrfs_read_locked_inode(). Patch commits are available in the stable kernel tree (e.g., 1e1f2055ad5a and 65241e3ddda6). Users should apply the relevant kernel update for their distribution as it becomes available. As a compensating control, restricting local user access on systems using Btrfs filesystems reduces exposure (Red Hat Bugzilla).