{ "cveId": "CVE-2026-90265", "url": "https://patchblox.com/security/cve/CVE-2026-90265", "summary": "CVE-2026-90265 is fixed in 35 products on 1 platform, first by DEBIAN-CVE-2026-90265, released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "btrfs: defrag: fix deadlock between defrag and delalloc space reservation", "description": "In the Linux kernel, the following vulnerability has been resolved: btrfs: defrag: fix deadlock between defrag and delalloc space reservation While running fsstress with autodefrag and flushoncommit, hit a deadlock due to the fact that defrag reserves delalloc space while it\u0027s holding dirty and locked folios, besides the extent range lock. The stack traces are the following: [958.624] task:kworker/u50:3 state:D stack:0 pid:20365 tgid:20365 ppid:2 task_flags:0x4208060 flags:0x00080000 [958.626] Workqueue: events_unbound btrfs_async_reclaim_metadata_space [btrfs] [958.627] Call Trace: [958.628] \u003CTASK\u003E [958.628] __schedule\u002B0x4be/0x10f0 [958.629] ? preempt_count_add\u002B0x69/0xa0 [958.630] schedule\u002B0x26/0xd0 [958.631] wait_current_trans\u002B0x102/0x160 [btrfs] [958.632] ? __pfx_autoremove_wake_function\u002B0x10/0x10 [958.633] start_transaction\u002B0x374/0x900 [btrfs] [958.634] btrfs_commit_current_transaction\u002B0x1d/0x70 [btrfs] [958.635] flush_space\u002B0xca/0x5e0 [btrfs] [958.636] ? _raw_spin_unlock\u002B0x15/0x30 [958.637] ? btrfs_reduce_alloc_profile\u002B0x8c/0x190 [btrfs] [958.639] ? _raw_spin_unlock\u002B0x15/0x30 [958.640] ? calc_available_free_space.isra.0\u002B0x6f/0x110 [btrfs] [958.641] do_async_reclaim_metadata_space\u002B0x84/0x190 [btrfs] [958.642] btrfs_async_reclaim_metadata_space\u002B0x64/0x80 [btrfs] [958.644] process_one_work\u002B0x19d/0x3a0 [958.644] worker_thread\u002B0x1c4/0x330 [958.645] ? __pfx_worker_thread\u002B0x10/0x10 [958.646] kthread\u002B0xfc/0x130 [958.647] ? __pfx_kthread\u002B0x10/0x10 [958.648] ret_from_fork\u002B0x1f7/0x2c0 [958.648] ? __pfx_kthread\u002B0x10/0x10 [958.649] ret_from_fork_asm\u002B0x1a/0x30 [958.650] \u003C/TASK\u003E [958.651] task:kworker/u49:7 state:D stack:0 pid:52990 tgid:52990 ppid:2 task_flags:0x4208060 flags:0x00080000 [958.653] Workqueue: writeback wb_workfn (flush-btrfs-334) [958.655] Call Trace: [958.655] \u003CTASK\u003E [958.656] __schedule\u002B0x4be/0x10f0 [958.657] ? __blk_flush_plug\u002B0xe9/0x140 [958.658] schedule\u002B0x26/0xd0 [958.658] io_schedule\u002B0x42/0x70 [958.659] folio_wait_bit_common\u002B0x12b/0x330 [958.660] ? folio_wait_bit_common\u002B0x100/0x330 [958.662] ? __pfx_wake_page_function\u002B0x10/0x10 [958.663] extent_write_cache_pages\u002B0x599/0x830 [btrfs] [958.664] ? acpi_fwnode_get_reference_args\u002B0x1fa/0x270 [958.665] btrfs_writepages\u002B0x77/0x130 [btrfs] [958.666] ? __pfx_end_bbio_data_write\u002B0x10/0x10 [btrfs] [958.667] do_writepages\u002B0xc6/0x160 [958.668] __writeback_single_inode\u002B0x42/0x310 [958.669] writeback_sb_inodes\u002B0x231/0x570 [958.670] wb_writeback\u002B0x8a/0x340 [958.671] wb_workfn\u002B0xbf/0x450 [958.672] ? finish_task_switch.isra.0\u002B0xc1/0x350 [958.673] process_one_work\u002B0x19d/0x3a0 [958.673] worker_thread\u002B0x1c4/0x330 [958.674] ? __pfx_worker_thread\u002B0x10/0x10 [958.675] kthread\u002B0xfc/0x130 [958.676] ? __pfx_kthread\u002B0x10/0x10 [958.676] ret_from_fork\u002B0x1f7/0x2c0 [958.677] ? __pfx_kthread\u002B0x10/0x10 [958.678] ret_from_fork_asm\u002B0x1a/0x30 [958.679] \u003C/TASK\u003E [958.679] task:btrfs-cleaner state:D stack:0 pid:296750 tgid:296750 ppid:2 task_flags:0x208040 flags:0x00080000 [958.681] Call Trace: [958.682] \u003CTASK\u003E [958.682] __schedule\u002B0x4be/0x10f0 [958.683] schedule\u002B0x26/0xd0 [958.684] handle_reserve_ticket\u002B0x1b9/0x2c0 [btrfs] [958.685] ? __pfx_autoremove_wake_function\u002B0x10/0x10 [958.686] reserve_bytes\u002B0x283/0x4c0 [btrfs] [958.687] btrfs_reserve_metadata_bytes\u002B0x18/0xb0 [btrfs] [958.688] btrfs_delalloc_reserve_metadata\u002B0x121/0x320 [btrfs] [958.690] btrfs_delalloc_reserve_space\u002B0x46/0xb0 [btrfs] [958.691] btrfs_defrag_file\u002B0x903/0x1110 [btrfs] [958.692] btrfs_run_defrag_inodes\u002B0x334/0x430 [btrfs] [958.694] cleaner_kthread\u002B0x97/0x1c0 [btrfs] [958.694] ? __pfx_cleaner_kthread\u002B0x10/0x10 [btrfs] [958.696] kthread\u002B0xfc/0x130 [958.696] ? __pfx_kthread\u002B0x10/0x10 [958.697] ret_ ---truncated---", "published": "2026-09-17T17:17:23Z", "severity": "Moderate", "cvss": 5.5, "epss": 0.00212, "epssPercentile": 0.11549, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-90265", "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "dtb-aarch64", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.84.1", "fix": "SUSE-SU-2026:4706-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4706-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "SUSE-SU-2026:24235-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24235-1", "released": "2026-11-07T00:44:01Z" }, { "platform": "linux", "product": "kernel-azure", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-azure", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.84.1", "fix": "SUSE-SU-2026:4706-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4706-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-azure", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "SUSE-SU-2026:24235-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24235-1", "released": "2026-11-07T00:44:01Z" }, { "platform": "linux", "product": "kernel-default", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-default", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.84.1", "fix": "SUSE-SU-2026:4706-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4706-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-default", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "SUSE-SU-2026:24197-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24197-1", "released": "2026-11-07T00:44:01Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1.160000.2.25", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.84.1.150700.17.47.1", "fix": "SUSE-SU-2026:4706-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4706-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.39.1.160000.2.26", "fix": "SUSE-SU-2026:24235-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24235-1", "released": "2026-11-07T00:44:01Z" }, { "platform": "linux", "product": "kernel-docs", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-docs", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.84.1", "fix": "SUSE-SU-2026:4706-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4706-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-docs", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "SUSE-SU-2026:24235-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24235-1", "released": "2026-11-07T00:44:01Z" }, { "platform": "linux", "product": "kernel-kvmsmall", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-kvmsmall", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "SUSE-SU-2026:24235-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24235-1", "released": "2026-11-07T00:44:01Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.54-121.166", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel-livepatch-SLE15-SP7-RT_Update_21", "release": "sles 15.7", "fixedVersion": "1-150700.1.3.1", "fix": "SUSE-SU-2026:4640-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4640-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-livepatch-SLE15-SP7_Update_22", "release": "sles 15.7", "fixedVersion": "1-150700.15.3.1", "fix": "SUSE-SU-2026:4706-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4706-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.84.1", "fix": "SUSE-SU-2026:4706-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4706-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-obs-qa", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-obs-qa", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "SUSE-SU-2026:24235-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24235-1", "released": "2026-11-07T00:44:01Z" }, { "platform": "linux", "product": "kernel-rt", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-source", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-source", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.84.1", "fix": "SUSE-SU-2026:4706-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4706-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-source", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "SUSE-SU-2026:24235-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24235-1", "released": "2026-11-07T00:44:01Z" }, { "platform": "linux", "product": "kernel-syms", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-syms", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.84.1", "fix": "SUSE-SU-2026:4706-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4706-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-syms", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "SUSE-SU-2026:24235-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24235-1", "released": "2026-11-07T00:44:01Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "OPENSUSE-SU-2026:22091-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22091-1", "released": "2026-11-07T00:47:19Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.84.1", "fix": "SUSE-SU-2026:4706-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4706-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.39.1", "fix": "SUSE-SU-2026:24235-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24235-1", "released": "2026-11-07T00:44:01Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.12.115-2", "fix": "DEBIAN-CVE-2026-90265", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90265", "released": "2026-09-23T19:19:02Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.2.6-1", "fix": "DEBIAN-CVE-2026-90265", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90265", "released": "2026-09-23T19:19:02Z" }, { "platform": "linux", "product": "microvm-kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T13:06:02Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }