NULL Pointer Dereference in Btrfs on Linux Kernel for Rescue Mounts

CVE-2026-74571

What is CVE-2026-74571?

A recent vulnerability identified in Btrfs on the Linux Kernel affects systems during rescue mounts, potentially causing a NULL pointer dereference when block group trees are corrupted. This issue arises with the 'rescue=ibadroots' parameter, allowing a mount to proceed even if crucial root pointers are NULL. As a result, functions like btrfs_update_global_block_rsv() may dereference a NULL pointer, leading to crashes. The resolution involves ensuring that rescue mounts remain read-only and properly managing the global block reserve accounting to prevent such dereferences.

References