CVE-2026-74571

Received Received - Intake

NULL Pointer Dereference in Linux Kernel Btrfs

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts [BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000100 RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs] Call Trace: fill_dummy_bgs+0xd4/0x120 [btrfs] open_ctree+0xc6e/0x1ca0 [btrfs] btrfs_get_tree+0x50d/0xa40 [btrfs] The same crash occurs with a corrupted raid stripe tree root, via btrfs_read_block_groups() instead of fill_dummy_bgs(). [CAUSE] With rescue=ibadroots, btrfs_read_roots() allows the mount to continue when either root cannot be read, leaving the corresponding root pointer NULL while its on-disk feature bit remains set. btrfs_update_global_block_rsv() then dereferences the missing root based on the feature bit alone. [FIX] Rescue mounts are fully read-only and cannot start transactions, so the global reserve is never consumed. Under btrfs_is_full_ro(), mark the reserve as full and return before performing the accounting. And since we need to check if the fs is mount fully RO, export fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h. [ Squash the fs_is_full_ro() export commit into this one. ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-05

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74571

EUVD

EUVD-2026-59636

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel occurs when mounting a btrfs filesystem with the rescue=ibadroots option after corrupting the block group or raid stripe tree root. It causes a NULL pointer dereference in the btrfs_update_global_block_rsv function, leading to a kernel crash. The issue arises because the mount continues despite missing roots, and the system incorrectly tries to access a null pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's btrfs filesystem and triggers during mount operations with rescue=ibadroots or corrupted raid stripe trees. Detection requires checking kernel logs for NULL pointer dereference errors during btrfs mount operations. Monitor system logs for messages indicating kernel crashes or btrfs-related errors.

Impact Analysis

If you use btrfs filesystems and encounter corruption in the block group or raid stripe tree, attempting to mount with rescue=ibadroots could crash your system. This results in a kernel panic, causing data loss or system unavailability until rebooted.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue causing a NULL pointer dereference during specific Btrfs filesystem mount operations with rescue flags. No data exposure or integrity issues are described that would impact regulatory compliance.

Mitigation Strategies

Apply the kernel patch that resolves this issue. Avoid using rescue=ibadroots mount option on btrfs filesystems. Ensure regular filesystem checks are performed to prevent corruption. Update to a patched kernel version if available.

Hi! I’m here to help you understand CVE-2026-74571. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70