CVE-2026-53284: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53284 Overview

CVE-2026-53284 is a Linux kernel vulnerability in the btrfs filesystem. The flaw resides in the btrfs_write_and_wait_transaction() code path, where the dirty pages IO tree is released even when writes fail. This leaves dirty extent buffers uncleaned, breaking the later transaction cleanup path and producing warnings and forced read-only states at unmount.

The issue triggers reliably under fault-injection workloads such as generic/388 combined with fsstress, resulting in aborted transactions, filesystem shutdown, and denial of service on affected systems.

Critical Impact
Local workloads that induce btrfs write errors can force the filesystem into a read-only state and leave extent buffers in an inconsistent state at unmount, causing kernel warnings and availability loss.

Affected Products

Linux kernel with btrfs filesystem support
Distributions shipping the affected upstream btrfs code prior to the fix commits
Systems mounting btrfs volumes in production storage stacks

Discovery Timeline

2026-06-26 - CVE-2026-53284 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53284

Vulnerability Analysis

The defect lives in the btrfs transaction commit path. btrfs_write_and_wait_transaction() submits all dirty extent buffers (ebs) for writeback and waits for completion. After the wait, it unconditionally calls btrfs_extent_io_tree_release() on the transaction's dirty_pages IO tree.

If btrfs_write_marked_extent() returns an error, the dirty_pages tree may still contain entries for extent buffers whose writes never completed. Releasing the tree in the error path discards the accounting records the cleanup code depends on.

The subsequent transaction cleanup path walks the dirty_pages IO tree to invalidate and clear dirty ebs. Because the tree has been emptied prematurely, those dirty buffers survive into invalidate_and_check_btree_folios(), which triggers WARNING output at disk-io.c:3311 during unmount.

Root Cause

The root cause is improper error handling around resource release ordering. The dirty_pages IO tree should only be released after writes succeed. Releasing it on the error branch destroys state required by later cleanup logic, resulting in leaked dirty extent buffers and a Kernel Vulnerability class defect impacting filesystem availability.

Attack Vector

Exploitation requires the ability to induce write failures on a mounted btrfs volume. This can occur through underlying block device errors, thin-provisioned volume exhaustion, dm-flakey style fault injection, or forced shutdown sequences similar to those used by generic/388. Any local process capable of generating heavy write load while the storage layer returns errors can drive the filesystem into the aborted transaction path and trigger the warning and forced read-only state.

The vulnerability manifests in kernel logic rather than parseable input, so no exploitation code applies. See the upstream fix commits referenced below for the exact patch.

Detection Methods for CVE-2026-53284

Indicators of Compromise

Kernel log entries containing BTRFS criticalemergency shutdown and error while writing out transaction: -30
BTRFS warning messages of the form unable to release extent buffer <n> owner <n> gen <n> refs <n> flags 0x7 at unmount
WARNING output referencing invalidate_and_check_btree_folios+0xfd/0x1ca [btrfs]
Filesystems transitioning to forced readonly state after transaction abort with errno=-30

Detection Strategies

Aggregate dmesg and /var/log/kern.log for btrfs abort, shutdown, and extent buffer release warnings across the fleet.
Alert on any btrfs filesystem transitioning to read-only during runtime, as this indicates transaction abort activity.
Track kernel versions across Linux hosts and flag systems running unpatched btrfs builds.

Monitoring Recommendations

Ship kernel ring buffer output to a centralized logging platform and create rules for BTRFS error and BTRFS critical strings.
Monitor btrfs sysfs state files under /sys/fs/btrfs/<uuid>/ for error transitions.
Correlate storage layer I/O errors with btrfs transaction abort events to identify affected hosts early.

How to Mitigate CVE-2026-53284

Immediate Actions Required

Inventory all Linux hosts using btrfs and identify kernel versions that predate the upstream fix commits.
Schedule kernel updates on affected systems, prioritizing servers with high write load or fault-prone storage.
Reduce exposure by stabilizing underlying block devices and thin-provisioned volumes that could return -ENOSPC or similar errors to btrfs.

Patch Information

The fix ensures the dirty_pages IO tree is only released after successful writes, preserving state required by the transaction cleanup path. Apply the upstream commits: kernel commit 4066c55e1094, kernel commit 9ebb7eba1237, and kernel commit df03d67dc637. Rebuild and reboot into a patched kernel or install a vendor kernel package that incorporates these commits.

Workarounds

Migrate critical workloads to a different filesystem such as ext4 or xfs until patched kernels are deployed.
Ensure storage backing btrfs volumes has sufficient capacity and reliability to avoid write errors that trigger the code path.
Avoid forced shutdown testing tools (godown, dm-flakey) on production btrfs volumes running unpatched kernels.

bash

# Verify running kernel version and btrfs module info
uname -r
modinfo btrfs | grep -E '^(filename|version|srcversion)'

# Watch for btrfs abort and warning events
dmesg -w | grep -Ei 'btrfs.*(error|critical|warning|readonly)'