CVE-2026-90261

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: flush active metadata block group at btree_writepages() start

btree_writepages() writes the btree inode's dirty metadata in ascending

logical address order. On a zoned filesystem only one metadata and one

system block group is active for writing at a time, and

check_bg_is_active() (via btrfs_check_meta_write_pointer()) pivots the

active block group as writeback moves from one block group to the next.

If the active block group sits at a higher logical address than another

block group that also holds dirty metadata, the ascending walk reaches

the lower one first and, to write it, has to finish the active block

group and activate the lower one. It cannot finish a block group that

still has unsent IO, and during WB_SYNC_ALL && !for_sync (commit)

writeback it deliberately refuses to wait for that IO under

fs_info->zoned_meta_io_lock, as that can deadlock. The pivot thus cannot

issue the submission itself ei

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References