CVE-2026-90261

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: flush active metadata block group at btree_writepages() start

btree_writepages() writes the btree inode's dirty metadata in ascending

logical address order. On a zoned filesystem only one metadata and one

system block group is active for writing at a time, and

check_bg_is_active() (via btrfs_check_meta_write_pointer()) pivots the

active block group as writeback moves from one block group to the next.

If the active block group sits at a higher logical address than another

block group that also holds dirty metadata, the ascending walk reaches

the lower one first and, to write it, has to finish the active block

group and activate the lower one. It cannot finish a block group that

still has unsent IO, and during WB_SYNC_ALL && !for_sync (commit)

writeback it deliberately refuses to wait for that IO under

fs_info->zoned_meta_io_lock, as that can deadlock. The pivot thus cannot

issue the submission itself either, so it gives up:

btrfs_check_meta_write_pointer() returns -EAGAIN, which

btrfs_write_and_wait_transaction() treats as fatal and aborts the

transaction, forcing the filesystem read-only. This happens

intermittently under metadata-heavy relocation (e.g. fstests btrfs/187).

Flush the active metadata and system block groups at the start of

btree_writepages(), under the fs_info->zoned_meta_io_lock it already

holds, so they have no unsent IO left and the later pivot can finish

them and make forward progress.