CVE-2026-64164

What it actually does

This flaw is a Linux kernel Btrfs issue in the btrfs_sync_file tracepoint. When the Btrfs sync-file trace event is enabled, the tracepoint path calls dput() from atomic context via dget_parent(), which can sleep where sleeping is not permitted. This triggers a kernel warning/splat such as “BUG: sleeping function called from invalid context” and may degrade stability or cause a crash on systems configured to panic on kernel warnings. Practical impact is denial of service rather than data theft or privilege escalation, and exploitation requires Btrfs usage plus the ability to enable or influence kernel tracing and trigger sync/write activity.

Why it matters to the business

Systems using Btrfs may experience kernel warnings, instability, or unexpected outages if the vulnerable trace event is enabled and the affected code path is exercised. The business risk is highest for production Linux hosts that use Btrfs and enable kernel tracing for diagnostics, observability, performance analysis, or troubleshooting. This issue is not known to be exploited in the wild, is not listed in CISA KEV, has no known ransomware association, and has a low EPSS score, so remediation should be handled through normal kernel maintenance unless affected tracing is actively used on critical systems.

How an attack unfolds

An attacker or operator with sufficient local privileges to enable Btrfs kernel trace events mounts or uses a Btrfs filesystem, enables the btrfs_sync_file trace event through tracefs/ftrace or an equivalent tracing tool, and then causes file sync activity such as pwrite/fsync workloads. When btrfs_sync_file() emits the trace event, the vulnerable tracepoint attempts to take and release a parent dentry reference in atomic context. The release path can sleep, causing the kernel to emit a sleeping-in-atomic-context warning. On systems configured with panic_on_warn or strict kernel debugging behavior, this warning can become a system crash, resulting in denial of service.

How to fix it

Upgrade to a Linux kernel version or distribution kernel package that includes the Btrfs tracepoint fix for btrfs_sync_file, which avoids dget_parent()/dput() in the trace event and directly accesses dentry->d_parent. Because no product-specific fixed versions were provided, use the latest stable kernel from the operating system vendor or the relevant upstream stable branch once the fix is backported. As a mitigation until patching is complete, avoid enabling the Btrfs sync-file trace event on production systems, restrict access to tracefs/debugfs and tracing tools to trusted administrators only, and consider disabling panic-on-warn behavior where operationally appropriate and consistent with security policy.

How to confirm the fix worked

Confirm the running kernel includes the vendor or upstream patch for the Btrfs btrfs_sync_file tracepoint. Validate exposure by checking whether systems use Btrfs and whether Btrfs trace events are enabled under tracefs, commonly mounted at /sys/kernel/tracing or /sys/kernel/debug/tracing. After patching, reproduce safely in a non-production environment by enabling the relevant Btrfs sync-file trace event and running a Btrfs write/fsync workload; the system should not emit “BUG: sleeping function called from invalid context” with a call trace through trace_event_raw_event_btrfs_sync_file, dput, and btrfs_sync_file. Also review kernel logs after patching to ensure no new splats are generated during Btrfs sync workloads.

Typical attack path

1. Gain local shell or administrative access sufficient to interact with kernel tracing facilities such as tracefs/ftrace.
2. Identify or create activity on a Btrfs filesystem.
3. Enable the vulnerable Btrfs sync-file trace event.
4. Trigger write and sync operations against files on the Btrfs filesystem.
5. Cause the kernel to execute the vulnerable tracepoint path in atomic context.
6. Induce kernel warnings, instability, or a panic if the host is configured to panic on warnings.

How to detect it

Review kernel logs from dmesg, journald, syslog, and centralized log collectors for kernel splats indicating sleeping in atomic context during Btrfs sync operations. High-confidence evidence includes log entries containing “BUG: sleeping function called from invalid context” with stack frames such as dput, trace_event_raw_event_btrfs_sync_file, btrfs_sync_file, btrfs_do_write_iter, vfs_write, or xfs_io. Check whether Btrfs tracing was enabled around the time of the event by reviewing tracefs state, shell history, auditd logs, sudo logs, and endpoint telemetry for writes to tracing control files under /sys/kernel/tracing/events/btrfs/ or /sys/kernel/debug/tracing/events/btrfs/. Because this issue does not provide a distinctive remote exploit artifact, detection should focus on kernel warning artifacts, tracing enablement, and local administrative activity preceding crashes or instability.

• BUG: sleeping function called from invalid context at fs/dcache.c
• in_atomic(): 1
• trace_event_raw_event_btrfs_sync_file
• btrfs_sync_file+
• btrfs_do_write_iter+
• dput.part.0+
• dput+
• /sys/kernel/tracing/events/btrfs/
• /sys/kernel/debug/tracing/events/btrfs/
• /sys/kernel/tracing/events/btrfs/btrfs_sync_file/enable
• /sys/kernel/debug/tracing/events/btrfs/btrfs_sync_file/enable
• echo 1 > /sys/kernel/tracing/events/btrfs/btrfs_sync_file/enable
• echo 1 > /sys/kernel/debug/tracing/events/btrfs/btrfs_sync_file/enable
• xfs_io
• panic_on_warn

What your security team should do

• Inventory Linux systems using Btrfs, especially production hosts where kernel tracing is used for observability, debugging, or performance analysis.
• Prioritize patching systems that combine Btrfs, enabled tracefs/ftrace access, and panic_on_warn or kernel debugging settings that can turn warnings into outages.
• Restrict tracefs/debugfs access to trusted administrators and audit use of tracing tools on shared or multi-user Linux systems.
• Disable or avoid the Btrfs sync-file trace event until patched if tracing is not operationally required.
• Monitor kernel logs for sleeping-in-atomic-context warnings involving Btrfs tracepoints.
• Track distribution kernel advisories for the exact fixed kernel package because fixed package versions were not provided in the input.
• Treat this as a stability and denial-of-service issue rather than an internet-exposed remote compromise, given no KEV listing, no known ransomware use, no named threat actors, and low EPSS.