CVE-2026-74321

CVE-2026-74321 is a regression in the Linux kernel's Btrfs filesystem where a refactoring that improved loop readability silently broke error recovery, creating a crash that only triggers on the second iteration after a specific failure condition. The vulnerability lives in btrfs_select_ref_head(). When that function returns ERR_PTR(-EAGAIN) under contention, the refactored code stores that error pointer directly in locked_ref instead of NULL. On the next loop iteration, the NULL check is bypassed, and spin_lock(&locked_ref->lock) dereferences an invalid pointer. This isn't a NULL dereference—reviewers see a valid pointer and a lock operation and move on. The crash only fires if EAGAIN occurs on the first pass through the loop. The loop counter question matters more than it first appears. If the counter increment was also lost in the refactoring and EAGAIN can persist under sustained memory pressure, you don't just get a crash—you get an infinite loop consuming CPU until the kernel OOM killer intervenes. The fix uses a goto to reach a cleanup block that was always correct but became unreachable after the refactoring. For defenders: check your kernel version if you're running Btrfs. The vulnerable code path requires specific contention conditions to trigger EAGAIN, which means this bug likely sat dormant in production kernels for months or years. The trigger is rare enough that standard testing may never have exercised it, but the failure mode escalates from a single-process crash to potential DoS if the loop counter is truly unbounded. Apply the patch regardless—restoring the state reset and counter increment is straightforward, and the goto pattern is a code smell worth auditing elsewhere in the filesystem code.

Reviewed through automated stages and approved by a human before publication.