{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: only release the dirty pages io tree after successful writes\\n\\n[WARNING]\\nWith extra warning on dirty extent buffers at umount (aka, the next\\npatch in the series), test case generic\/388 can trigger the following\\nwarning about dirty extent buffers at unmount time:\\n\\n BTRFS critical (device dm-2 state E): emergency shutdown\\n BTRFS error (device dm-2 state E): error while writing out transaction: -30\\n BTRFS warning (device dm-2 state E): Skipping commit of aborted transaction.\\n BTRFS error (device dm-2 state EA): Transaction 9 aborted (error -30)\\n BTRFS: error (device dm-2 state EA) in cleanup_transaction:2068: errno=-30 Readonly filesystem\\n BTRFS info (device dm-2 state EA): forced readonly\\n BTRFS info (device dm-2 state EA): last unmount of filesystem 4fbf2e15-f941-49a0-bc7c-716315d2777c\\n ————[ cut here ]————\\n WARNING: disk-io.c:3311 at invalidate_and_check_btree_folios+0xfd\/0x1ca [btrfs], CPU#8: umount\/914368\\n CPU: 8 UID: 0 PID: 914368 Comm: umount Tainted: G OE 7.1.0-rc1-custom+ #372 PREEMPT(full) 2de38db8d1deae71fde295430a0ff3ab98ccf596\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02\/02\/2022\\n RIP: 0010:invalidate_and_check_btree_folios+0xfd\/0x1ca [btrfs]\\n Call Trace:\\n \\u003cTASK\\u003e\\n close_ctree+0x52e\/0x574 [btrfs d2f0b1cd330d1287e7a9919d112eadfc0e914efd]\\n generic_shutdown_super+0x89\/0x1a0\\n kill_anon_super+0x16\/0x40\\n btrfs_kill_super+0x16\/0x20 [btrfs d2f0b1cd330d1287e7a9919d112eadfc0e914efd]\\n deactivate_locked_super+0x2d\/0xb0\\n cleanup_mnt+0xdc\/0x140\\n task_work_run+0x5a\/0xa0\\n exit_to_user_mode_loop+0x123\/0x4b0\\n do_syscall_64+0x243\/0x7c0\\n entry_SYSCALL_64_after_hwframe+0x4b\/0x53\\n \\u003c\/TASK\\u003e\\n —[ end trace 0000000000000000 ]—\\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30539776 owner 9 gen 9 refs 2 flags 0x7\\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30621696 owner 257 gen 9 refs 2 flags 0x7\\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30638080 owner 258 gen 9 refs 2 flags 0x7\\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30654464 owner 7 gen 9 refs 2 flags 0x7\\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30703616 owner 2 gen 9 refs 2 flags 0x7\\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30720000 owner 10 gen 9 refs 2 flags 0x7\\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30736384 owner 4 gen 9 refs 2 flags 0x7\\n BTRFS warning (device dm-2 state EA): unable to release extent buffer 30752768 owner 11 gen 9 refs 2 flags 0x7\\n\\nI’m using a stripped down version, which seems to trigger the warning\\nmore reliably:\\n\\n _fsstress_pid=\\”\\”\\n workload()\\n {\\n \\tdmesg -C\\n \\tmkfs.btrfs -f -K $dev \\u003e \/dev\/null\\n \\techo 1 \\u003e \/sys\/kernel\/debug\/clear_warn_once\\n \\tmount $dev $mnt\\n \\t$fsstress -w -n 1024 -p 4 -d $mnt \\u0026\\n \\t_fsstress_pid=$!\\n \\tsleep 0\\n \\t$godown $mnt\\n \\tpkill –echo -PIPE fsstress \\u003e \/dev\/null\\n \\twait $_fsstress_pid\\n \\tunset _fsstress_pid\\n \\tumount $mnt\\n\\n \\tif dmesg | grep -q \\”WARNING\\”; then\\n \\t\\tfail\\n \\tfi\\n }\\n\\n for (( i = 0; i \\u003c $runtime; i++ )); do\\n \\techo \\”=== $i\/$runtime ===\\”\\n \\tworkload\\n done\\n\\n[CAUSE]\\nInside btrfs_write_and_wait_transaction(), we first try to write all\\ndirty ebs, then wait for them to finish.\\n\\nAfter that we call btrfs_extent_io_tree_release() to free all\\nextent states from dirty_pages io tree.\\n\\nHowever if we hit an error from btrfs_write_marked_extent(), then we\\nstill call btrfs_extent_io_tree_release() to clear that dirty_pages io\\ntree, which may contain dirty records that we haven’t yet submitted.\\n\\nFurthermore, the later transaction cleanup path will utilize that\\ndirty_pages io tree to properly cleanup those dirty ebs, but since it’s\\nalready empty, no dirty ebs are properly cleaned up, thus will later\\ntrigger the warnings inside invalidate_btree_folios().\\n—truncated—“,”published”:”2026-06-26T19:40:45.444Z”,”modified”:”2026-06-28T06:41:24.506Z”,”type”:”cve”,”title”:”btrfs: only release the dirty pages io tree after successful writes”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/9ebb7eba1237dc198768b9c76506a79f924c82bb\\nhttps:\/\/git.kernel.org\/stable\/c\/df03d67dc63722845cb9fe59d815d1225b04fd54\\nhttps:\/\/git.kernel.org\/stable\/c\/4066c55e109475a06d18a1f127c939d551211956″,”id”:”CVE-2026-53284″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\\nLinux Linux 0\\nLinux Linux 0″,”sourceHref”:””,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”1da177e4c3f41524e886b7f1b8a0c1fc7321cac2″,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: only release the dirty pages io tree after successful writes\\n\\n[WARNING]\\nWith extra warning on dirty extent…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,16,12,15,13,7,11,5],"class_list":["post-66458","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n