CVE-2026-74572: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74572 is a deadlock vulnerability in the Linux kernel's btrfs zoned filesystem implementation, specifically between metadata writeback and transaction commit operations. It was published on August 15, 2026, and affects Linux kernel versions starting from 6.5.5 up to (but not including) 6.6, as well as kernel 6.6 itself prior to the respective stable fixes. Fixed versions include 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2+. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is an improper lock management pattern in btree_writepages(), which holds fs_info->zoned_meta_io_lock across the entire writeback loop. When processing the tree-log block group, check_bg_is_active() may fail to activate a zone and fall back to btrfs_zone_finish_one_bg(), which waits for the running transaction to commit — but the transaction committer (Task B) also needs zoned_meta_io_lock to write tree extents, creating a circular wait (deadlock). The fix mirrors the approach already used in a sibling branch of check_bg_is_active(): releasing zoned_meta_io_lock around the btrfs_zone_finish_one_bg() call and re-acquiring it afterward, since the lock only protects fs_info->active_{meta,system}_bg and ctx->zoned_bg maintains a reference to the block group across the unlock. This bug can be reproduced with fstests generic/475 on a zoned btrfs filesystem (GitHub Advisory).

Successful triggering of this vulnerability causes a kernel deadlock, rendering the affected system frozen or completely unresponsive — a full Denial of Service. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems running btrfs on zoned block devices (e.g., SMR hard drives or NVMe ZNS devices) under concurrent metadata writeback and transaction commit workloads are at risk of an unrecoverable hang requiring a hard reboot (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.156% (Feedly) / 0.346% (GitHub Advisory), placing it in a low-to-moderate exploitation probability range. Triggering the deadlock requires local access to a system running btrfs on zoned block devices with concurrent filesystem stress operations (GitHub Advisory).

• Logs: Kernel logs (dmesg / journalctl -k) showing hung task warnings (e.g., INFO: task kworker:... blocked for more than 120 seconds) involving btree_writepages, btrfs_zoned_meta_io_lock, or btrfs_zone_finish_one_bg.
• Process Behavior: Kernel worker threads (kworker) and filesystem stress processes (e.g., fsstress) stuck in uninterruptible sleep (D state) visible via ps aux or top.
• File System: Btrfs filesystem on a zoned block device becoming unresponsive — I/O operations hanging indefinitely with no completion.
• System: Complete system freeze or watchdog-triggered reboot on hosts using btrfs with zoned storage under heavy metadata write workloads.

Update the Linux kernel to a version containing the fix: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2+. The fix commits are available in the stable kernel tree (e.g., 18577e77c2c8, c3320873e0c0, deddd28fd83c, 75859a7cd77c, 1ebe51c29fa9). As a temporary workaround, avoid running heavy concurrent metadata writeback and transaction commit workloads on btrfs zoned filesystems until the patch is applied; monitoring for hung task kernel messages can provide early warning of the condition (GitHub Advisory).