---
id: CVE-2026-74571
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: skip global block reserve accounting for rescue mounts

  [BUG]
  Mounting with rescue=ibadroots after corrupting the block group tree
  root triggers a NULL pointer d…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: skip global block reserve accounting for rescue mounts

  [BUG]
  Mounting with rescue=ibadroots after corrupting the block group tree
  root triggers a NULL pointer d…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8dbfc14fc736eb701089aff09645c3d4ad3decb1 <
    969a96479add6bd42d7f7241f99f27b31571a953
  - >-
    Linux >= 8dbfc14fc736eb701089aff09645c3d4ad3decb1 <
    076349e4c8d11f6b58c4549976a513b2b4dc6df2
  - >-
    Linux >= 8dbfc14fc736eb701089aff09645c3d4ad3decb1 <
    51a0e8399858621442807a26057bcd1cd3ced046
  - Linux cbec34d3021d47007a0334c634f7053dbaf93d02
  - Linux 1e8087589b5cf6fa17adaf57b64cf1656d77dfec
  - Linux >= 6.1.43 < 6.2
  - Linux >= 6.4.8 < 6.5
  - Linux 6.5
published: '2026-08-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:48.057'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74571'
references:
  - url: 'https://git.kernel.org/stable/c/076349e4c8d11f6b58c4549976a513b2b4dc6df2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/51a0e8399858621442807a26057bcd1cd3ced046'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/969a96479add6bd42d7f7241f99f27b31571a953'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00198
epssPercentile: 0.08859
ingestedAt: '2026-10-15T11:00:41.671Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: skip global block reserve accounting for rescue mounts

[BUG]
Mounting with rescue=ibadroots after corrupting the block group tree
root triggers a NULL pointer dereference:

  BUG: kernel NULL pointer dereference, address: 0000000000000100
  RIP: 0010:btrfs_update_global_block_rsv+0x9d/0x1c0 [btrfs]
  Call Trace:
   fill_dummy_bgs+0xd4/0x120 [btrfs]
   open_ctree+0xc6e/0x1ca0 [btrfs]
   btrfs_get_tree+0x50d/0xa40 [btrfs]

The same crash occurs with a corrupted raid stripe tree root, via
btrfs_read_block_groups() instead of fill_dummy_bgs().

[CAUSE]
With rescue=ibadroots, btrfs_read_roots() allows the mount to continue
when either root cannot be read, leaving the corresponding root pointer
NULL while its on-disk feature bit remains set.

btrfs_update_global_block_rsv() then dereferences the missing root based
on the feature bit alone.

[FIX]
Rescue mounts are fully read-only and cannot start transactions, so the
global reserve is never consumed. Under btrfs_is_full_ro(), mark the
reserve as full and return before performing the accounting.

And since we need to check if the fs is mount fully RO, export
fs_is_full_ro() as btrfs_is_full_ro(), and move it to fs.h.

[ Squash the fs_is_full_ro() export commit into this one. ]

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.