Linux kernel (btrfs) vulnerabilities

A deadlock exists in the Linux kernel's btrfs filesystem during file defragmentation when autodefrag is enabled. Defrag reserves delalloc space while holding dirty and locked folios plus the extent range lock, causing kernel tasks (btrfs-cleaner, writeback, metadata reclaim) to block each other.

A flaw was found in the Linux kernel btrfs subsystem where write-protection of folios during data writeback was lost. A code change replaced folio_clear_dirty_for_io() with a plain folio_test_dirty() check, allowing a process with an mmap-ed file to modify sectors while writeback is in progress. This can cause checksum corruption, lost writes, and data corruption for compressed or inline extents.

A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().