Cloudanix VulnDB

CVE-2026-90266

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A file-system bug on certain high-capacity zoned drives could unexpectedly switch the drive to read-only mode during normal heavy use, interrupting ongoing work.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Transient -EAGAIN from btrfs_delayed_refs_rsv_refill during zoned block-group reclaim aborts the transaction and forces the filesystem read-only instead of retrying.

Why it matters to the business

Workloads writing to zoned Btrfs volumes can experience sudden loss of write access, leading to application stalls, failed backups, or service outages until manual intervention.

How an attack unfolds

An attacker or heavy metadata workload pushes a zoned filesystem past its usable block-group size during reclaim; the resulting -EAGAIN triggers an abort that converts the mount to read-only without recovery.

How to fix it

Upgrade to a Linux kernel containing the btrfs zoned reclaim fix that treats -EAGAIN as retryable instead of fatal.

How to confirm the fix worked

Boot the patched kernel, reproduce metadata pressure on a zoned device, and confirm the filesystem remains writable with no transaction abort logged.

Typical attack path

  1. Generate sustained metadata reservations that over-commit a zoned block group
  2. Trigger reclaim operations while the reservation refill returns -EAGAIN
  3. Observe transaction abort and forced read-only transition in kernel logs
  4. Continue writes to confirm loss of write access

How to detect it

Search kernel logs on systems with zoned block devices for btrfs transaction aborts tied to delayed-refs reservation failures or zone-unusable conditions.

  • btrfs_delayed_refs_rsv_refill.*-EAGAIN
  • transaction aborted.*reclaim
  • zone_unusable.*exceeds usable size

What your security team should do

  • Prioritize kernel updates on any systems using zoned Btrfs storage
  • Add monitoring for 'transaction aborted' and 'EAGAIN' messages in kernel logs
  • Test failover or remount procedures for affected volumes before patching

The record

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge On a zoned FS, btrfs_delayed_refs_rsv_refill() returns -EAGAIN whenever the over-committed metadata plus the zone_unusable bytes exceeds the usable size in a metadata block-group to avoid heavy over-commit of metadata and early ENOSPC in one transaction. If this happens while doing reclaim, the transaction is getting aborted. Treat -EAGAIN as a soft, retryable condition in case of block-group reclaim.

Affected packages

Ecosystem Package Introduced Fixed