CVE-2026-90260: btrfs: zoned: don't clobber the extent buffer when zeroing it out

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: don't clobber the extent buffer when zeroing it out

On a zoned filesystem a freed-but-still-dirty tree block is written out
as zeros (EXTENT_BUFFER_ZONED_ZEROOUT) only to keep the zone write
pointer advancing. btree_csum_one_bio() implemented this by memzeroing
the extent buffer's own folios before submission.

That destroys the in-memory buffer while it may still be referenced. In
particular btrfs_free_tree_block() can run on it afterwards and reads
the header to add a delayed reference; once the header has been zeroed
it frees bytenr 0 and corrupts the extent tree (the
btrfs_header_bytenr(buf) != 0 ASSERT in btrfs_free_tree_block(), or an
"unable to find ref" abort). It is flaky and reproduces under fsstress,
e.g. generic/461 and generic/013.

Write the zeros to disk from the shared zero page instead and leave the
extent buffer content untouched, so any later reference - including the
delayed reference from btrfs_free_tree_block() - still sees a valid
header. end_bbio_meta_write() now clears writeback on the buffer's own
folios, as the bio no longer carries them.

The Linux kernel CVE team has assigned CVE-2026-90260 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.8 with commit aa6313e6ff2bfbf736a2739047bba355d8241584 and fixed in 6.18.52 with commit 92484ad014f2e2b0e0e7bbc1610951e978cf557c
	Issue introduced in 6.8 with commit aa6313e6ff2bfbf736a2739047bba355d8241584 and fixed in 7.2.6 with commit 98e3747587f9f87f010d8d7e55786216249a94af
	Issue introduced in 6.8 with commit aa6313e6ff2bfbf736a2739047bba355d8241584 and fixed in 7.3-rc1 with commit db4b9eefc8ee0bcaeee4d5e6a7313905f6a2fe7c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-90260
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/btrfs/disk-io.c
	fs/btrfs/extent_io.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/92484ad014f2e2b0e0e7bbc1610951e978cf557c
	https://git.kernel.org/stable/c/98e3747587f9f87f010d8d7e55786216249a94af
	https://git.kernel.org/stable/c/db4b9eefc8ee0bcaeee4d5e6a7313905f6a2fe7c