Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74321— btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 4.20版本存在安全漏洞，该漏洞源于btrfs的__btrfs_run_delayed_refs()函数在处理btrfs_select_ref_head()返回的-EAGAIN错误指针时，未将locked_ref置为NULL，导致对无效指针进行解引用，可能导致内核崩溃。

CVSS 7.5 · High EPSS 0.72% · P53

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 0110a4c43451533de1ea1bbdc57b5d452f9d8b25< c372ca227e16bace86f1df1fa4ae6849e2fcfa28 affected
0110a4c43451533de1ea1bbdc57b5d452f9d8b25< a71143590ce9764dbcb47617647592ff8b4d48bc affected
0110a4c43451533de1ea1bbdc57b5d452f9d8b25< 65770111a2d47c2b15e20b2ba92bb12198f289d4 affected
0110a4c43451533de1ea1bbdc57b5d452f9d8b25< 015dc4a1e0c2cba551d4620eba13d26d5081dc34 affected
0110a4c43451533de1ea1bbdc57b5d452f9d8b25< ba9fa2ff5981589bb49094d3358c339b37c47f53 affected
0110a4c43451533de1ea1bbdc57b5d452f9d8b25< 3b15d02be05e74321adb1e0ae0cb4ccfba7c6cb1 affected
0110a4c43451533de1ea1bbdc57b5d452f9d8b25< 9faa6b69ad73f03c7bde53e07d75a28822dc9a1a affected
0110a4c43451533de1ea1bbdc57b5d452f9d8b25< 486f8298b6188ff11ef1f4be7f1d5d2e4d1b1fae affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74321

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() In the beginning of the loop, we try to obtain a locked delayed ref head, if 'locked_ref' is currently NULL, by calling btrfs_select_ref_head(), which can return an error pointer. If the error pointer is -EAGAIN we do a continue and go back to the beginning of the loop, which will not try again to call btrfs_select_ref_head() since 'locked_ref' is no longer NULL but it's ERR_PTR(-EAGAIN), and then we do: spin_lock(&locked_ref->lock); against a ERR_PTR(-EAGAIN) value, generating an invalid pointer dereference. Fix this by ensuring that 'locked_ref' is set to NULL when btrfs_select_ref_head() returns ERR_PTR(-EAGAIN) and incrementing 'count' as well, to prevent infinite looping. We do this by doing a goto to the bottom of the loop that already sets 'locked_ref' to NULL and does a cond_resched(), with an increment to 'count' right before the goto. These measures were in place before the refactoring in commit 0110a4c43451 ("btrfs: refactor __btrfs_run_delayed_refs loop") but were unintentionally lost afterwards.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 4.20版本存在安全漏洞，该漏洞源于btrfs的__btrfs_run_delayed_refs()函数在处理btrfs_select_ref_head()返回的-EAGAIN错误指针时，未将locked_ref置为NULL，导致对无效指针进行解引用，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 0110a4c43451533de1ea1bbdc57b5d452f9d8b25 ~ c372ca227e16bace86f1df1fa4ae6849e2fcfa28 -
Linux Linux 4.20 -

II. Public POCs for CVE-2026-74321

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74321

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74321 (8)

Same Patch Batch · Linux · 2026-08-15 · 844 CVEs total

CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-74398 9.8 CRITICAL ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
CVE-2026-72191 9.8 CRITICAL ntfs3: validate split-point offset in indx_insert_into_buffer
CVE-2026-74315 9.8 CRITICAL lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()
CVE-2026-72084 9.8 CRITICAL scsi: target: Bound PR-OUT TransportID parsing to the received buffer
CVE-2026-72083 9.8 CRITICAL scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
CVE-2026-74401 9.8 CRITICAL dlm: fix add msg handle in send_queue ordered
CVE-2026-72249 9.8 CRITICAL netfilter: flowtable: use dst in this direction when pushing IPIP header
CVE-2026-74493 9.8 CRITICAL net/smc: fix socket use-after-free during link group termination
CVE-2026-74345 9.8 CRITICAL RDMA/siw: Fix endpoint/socket association handling
CVE-2026-72251 9.8 CRITICAL netfilter: nf_nat_sip: reload possible stale data pointer
CVE-2026-72248 9.8 CRITICAL netfilter: flowtable: support IPIP tunnel with direct xmit
CVE-2026-74495 9.8 CRITICAL igbvf: Fix leak in TX DMA error cleanup

Showing top 20 of 844 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74321

No comments yet

Leave a comment