CVE-2026-23036 Overview
A deadlock vulnerability has been discovered in the Linux kernel's Btrfs filesystem implementation. The flaw exists in the btrfs_read_locked_inode() function where improper lock ordering can trigger an ABBA deadlock scenario. When the function fails to lookup an inode, it jumps to the 'out' label while still holding a read lock on a leaf node, then calls iget_failed(). This triggers inode eviction which attempts to release the delayed inode by acquiring the delayed inode's mutex, creating a circular locking dependency with tasks that update delayed inodes in a different lock order.
Critical Impact
This vulnerability can cause system deadlocks, leading to denial of service conditions on systems using the Btrfs filesystem. The circular locking dependency between btrfs-tree-00 and delayed_node->mutex can halt critical kernel operations.
Affected Products
- Linux kernel with Btrfs filesystem support
- Systems running Btrfs as root or data filesystem
- Kernel versions prior to the security patch
Discovery Timeline
- 2026-01-31 - CVE CVE-2026-23036 published to NVD
- 2026-02-03 - Last updated in NVD database
Technical Details for CVE-2026-23036
Vulnerability Analysis
This vulnerability represents a classic ABBA deadlock pattern in the Linux kernel's Btrfs filesystem code. The deadlock occurs due to inconsistent lock acquisition ordering between two kernel subsystems: the Btrfs tree locking mechanism and the delayed inode management system.
The deadlock manifests when two execution paths attempt to acquire the same pair of locks in opposite orders:
Path 1 (btrfs-cleaner thread): Holds btrfs-tree-00 read lock → Attempts to acquire delayed_node->mutex
Path 2 (Delayed inode update): Holds delayed_node->mutex → Attempts to acquire btrfs-tree-00 via btrfs_search_slot()
When btrfs_read_locked_inode() encounters an inode lookup failure, the error handling path incorrectly maintains the tree read lock before calling iget_failed(). The subsequent inode eviction process requires releasing the delayed inode, which must lock the delayed node's mutex. Meanwhile, any concurrent delayed inode update operation holds the mutex first, then attempts tree operations requiring the same lock class.
The kernel's lockdep subsystem detected this circular dependency, producing a warning about the potential deadlock between &delayed_node->mutex and btrfs-tree-00 lock classes.
Root Cause
The root cause is improper lock release sequencing in the error handling path of btrfs_read_locked_inode(). The function fails to release the Btrfs tree path (and its associated read lock on the leaf node) before calling iget_failed(). This violates the established lock ordering convention where tree locks should be released before operations that may acquire the delayed inode mutex.
The fix requires releasing the path before any call to iget_failed() to ensure proper lock ordering is maintained and prevent the ABBA deadlock scenario.
Attack Vector
The vulnerability can be triggered through normal filesystem operations that cause inode lookup failures during Btrfs defragmentation or metadata space reclamation operations. While the attack vector is primarily local, the deadlock can be triggered by:
The btrfs-cleaner kernel thread running defrag operations may encounter inode lookup failures, and concurrent metadata space reclamation activities can create the race conditions necessary for the deadlock. When triggered, the system can become unresponsive as kernel threads wait indefinitely for locks held by each other.
Since no external code execution is required to trigger this vulnerability, exploitation complexity depends on creating the right timing conditions between concurrent Btrfs operations.
Detection Methods for CVE-2026-23036
Indicators of Compromise
- Kernel log messages containing WARNING: possible circular locking dependency detected referencing btrfs-cleaner and delayed_node->mutex
- System hangs or unresponsiveness during Btrfs filesystem operations, particularly defragmentation
- Lockdep splat messages in dmesg output showing the lock dependency chain between btrfs-tree-00 and &delayed_node->mutex
- Stuck btrfs-cleaner kernel threads visible in process listings
Detection Strategies
- Monitor kernel logs for lockdep warnings containing btrfs and circular locking dependency
- Implement watchdog monitoring for Btrfs-related kernel threads that may become stuck
- Use cat /proc/lockdep_chains to analyze current lock dependency information on systems with lockdep enabled
- Configure alerting on kernel hang detection mechanisms like soft lockup detectors
Monitoring Recommendations
- Enable kernel lockdep debugging (CONFIG_PROVE_LOCKING) in development and testing environments to detect lock ordering issues
- Monitor Btrfs filesystem health using btrfs device stats and check for unexpected errors
- Implement system health checks that detect prolonged unresponsiveness of Btrfs maintenance threads
- Review kernel logs periodically for any locking-related warnings involving Btrfs components
How to Mitigate CVE-2026-23036
Immediate Actions Required
- Apply the kernel patches from the official kernel Git repository immediately
- Schedule system reboots to activate the patched kernel on affected systems
- Consider temporarily disabling automatic Btrfs defragmentation if patches cannot be applied immediately
- Monitor systems for signs of deadlock conditions until patches are fully deployed
Patch Information
The vulnerability has been addressed in upstream kernel commits. System administrators should update to patched kernel versions containing the fix. The patches are available through the official kernel Git repositories:
The fix ensures that the Btrfs tree path is properly released before calling iget_failed(), maintaining correct lock ordering and preventing the ABBA deadlock condition.
Workarounds
- Reduce concurrent Btrfs operations by limiting automated defragmentation and balance operations during high-load periods
- If automatic defragmentation is enabled, consider disabling it temporarily using btrfs property set /mountpoint compression "" or removing autodefrag mount option
- Increase system monitoring to detect and respond to deadlock conditions quickly, allowing for manual recovery
- Consider using alternative filesystems for workloads with high inode churn until patched kernels are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
