CVE-2026-74571

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the btrfs module when mounting with the rescue=ibadroots option after the block group tree root or the raid stripe tree root has been corrupted. This happens because btrfs read roots() allows the mount process to continue even if a root cannot be read, leaving the root pointer as NULL while the on-disk feature bit remains set. Subsequently, the btrfs update global block rsv() function attempts to dereference the missing root based solely on the feature bit, leading to a kernel crash. This issue can be triggered via the fill dummy bgs() or btrfs read block groups() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.