Cloudanix VulnDB

CVE-2026-90262

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug in the btrfs file system can turn temporary read problems into permanent errors, causing unexpected failures when checking file integrity.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability in btrfs_read_merkle_tree_page() causes a not-uptodate Merkle folio found in the page cache to be treated as a permanent read error returning -EIO instead of retrying the read, making transient failures sticky.

Why it matters to the business

Btrfs file systems with verity enabled may experience unnecessary and persistent I/O failures during normal operations, leading to application errors, service disruptions, or degraded reliability on affected Linux systems.

How an attack unfolds

An attacker triggers a transient read failure on a Merkle tree page to leave a not-uptodate folio in the mapping; subsequent legitimate accesses then fail with -EIO without retrying, amplifying the impact of the initial fault.

How to fix it

Apply the kernel patch that retries Merkle item reads when a not-uptodate folio is encountered and unlocks the folio on read_key_bytes() failure to allow later retries.

How to confirm the fix worked

Inspect btrfs source for the updated retry logic in btrfs_read_merkle_tree_page(); monitor kernel logs for absence of spurious -EIO errors on verity reads after transient failures.

Typical attack path

  1. Cause a transient read error on a btrfs Merkle tree page
  2. Leave the not-uptodate folio cached in the mapping
  3. Trigger repeated access attempts that now fail with -EIO instead of retrying

How to detect it

Search kernel logs and dmesg for btrfs_read_merkle_tree_page entries returning -EIO; look for patterns of repeated failures on the same Merkle folios after transient I/O events.

  • btrfs_read_merkle_tree_page
  • -EIO
  • not-uptodate folio
  • read_key_bytes

What your security team should do

  • Prioritize kernel updates containing the btrfs verity retry fix once released
  • Monitor system logs for repeated btrfs EIO errors on Merkle tree operations
  • Test btrfs verity workloads under simulated transient read failures to confirm retry behavior

The record

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfs_read_merkle_tree_page() can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns -EIO. That can make a previous transient read failure sticky. If the failed read left a not-uptodate folio in the mapping, later callers find that folio and fail instead of retrying the read. Keep the existing page-cache insertion and locking order, but retry the Merkle item read when a not-uptodate folio is found in the mapping. Also unlock the folio when read_key_bytes() fails so that a later caller can lock it and retry the read.

Affected packages

Ecosystem Package Introduced Fixed