In the Linux kernel, the following vulnerability has been resolved:

btrfs: take commit root semaphore when iterating in mark block group to copy()

mark block group to copy() iterates over the commit root with skip locking=true. A concurrent transaction commit can swap and free the commit root during iteration, causing use-after-free when accessing extent buffers.

Fix it by using path->need commit sem to protect the commit root search.