Strix
64.1K

CVE-2026-90262

Unknown

Last modified

CVE-2026-90262 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfs_read_merkle_tree_page() can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns -EIO. That can make a previous transient read failure sticky.

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfs_read_merkle_tree_page() can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns -EIO. That can make a previous transient read failure sticky. If the failed read left a not-uptodate folio in the mapping, later callers find that folio and fail instead of retrying the read. Keep the existing page-cache insertion and locking order, but retry the Merkle item read when a not-uptodate folio is found in the mapping. Also unlock the folio when read_key_bytes() fails so that a later caller can lock it and retry the read.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 06ed09351b67eb1114ae106a87a0ee3ea9adb3db, < 90e9eae1b5907fa36620ffb7f4f1a4afa9333427; >= 06ed09351b67eb1114ae106a87a0ee3ea9adb3db, < c1fa005cdf3b7ff14cdfd7d512830088a3fc256b; >= 06ed09351b67eb1114ae106a87a0ee3ea9adb3db, < 12b6d1a1715cbced2e445ca353f9c9987b8636e2; >= 06ed09351b67eb1114ae106a87a0ee3ea9adb3db, < 81241f734f0f662378f5ffc53882b012923e6fe5; >= 06ed09351b67eb1114ae106a87a0ee3ea9adb3db, < 8cc569696dac51fc62bb39b3b8f530582b916d29
LinuxLinux6.6

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-90262?
In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfs_read_merkle_tree_page() can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns -EIO. That can make a previous transient read failure sticky. If the failed read left a not-uptodate folio in the mapping, later callers find that folio and fail instead of retrying the read. Keep the existing page-cache insertion and locking order, but retry the Merkle item read when a not-uptodate folio is found in the mapping. Also unlock the folio when read_key_bytes() fails so that a later caller can lock it and retry the read.
How severe is CVE-2026-90262?
Severity scoring for CVE-2026-90262 is pending analysis.
How do I fix CVE-2026-90262?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-90262?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST