CVE-2026-90262

Summary

In the Linux kernel, the following vulnerability has been resolved:

btrfs: retry verity reads for not-uptodate Merkle folios

btrfs_read_merkle_tree_page() can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns -EIO.

That can make a previous transient read failure sticky. If the failed read left a not-uptodate folio in the mapping, later callers find that folio and fail instead of retrying the read.

Keep the existing page-cache insertion and locking order, but retry the Merkle item read when a not-uptodate folio is found in the mapping. Also unlock the folio when read_key_bytes() fails so that a later caller can lock it and retry the read.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux06ed09351b67eb1114ae106a87a0ee3ea9adb3db < 90e9eae1b5907fa36620ffb7f4f1a4afa9333427affected
LinuxLinux06ed09351b67eb1114ae106a87a0ee3ea9adb3db < c1fa005cdf3b7ff14cdfd7d512830088a3fc256baffected
LinuxLinux06ed09351b67eb1114ae106a87a0ee3ea9adb3db < 12b6d1a1715cbced2e445ca353f9c9987b8636e2affected
LinuxLinux06ed09351b67eb1114ae106a87a0ee3ea9adb3db < 81241f734f0f662378f5ffc53882b012923e6fe5affected
LinuxLinux06ed09351b67eb1114ae106a87a0ee3ea9adb3db < 8cc569696dac51fc62bb39b3b8f530582b916d29affected
LinuxLinux6.6affected
LinuxLinux0 < 6.6unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References