CVE-2026-74365

Status: UPDATED  |  Advisory ID: CVE-2026-74365

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

nvdimm/btt: Handle preemption in BTT lane acquisition

BTT lanes serialize access to per-lane metadata and workspace state

during BTT I/O. The btt-check unit test reports data mismatches during

BTT writes due to a race in lane acquisition that can lead to silent

data corruption.

The existing lane model uses a spinlock together with a per-CPU

recursion count. That recursion model stopped being valid after BTT

lanes became preemptible: another task can run on the same CPU,

observe a non-zero recursion count, bypass locking, and use the same

lane concurrently.

BTT lanes are also held across arena_write_bytes() calls. That path

reaches nsio_rw_bytes(), which flushes writes with nvdimm_flush().

Some provider flush callbacks can sleep, making a spinlock the wrong

primitive for the lane lifetime.

Replace the spinlock-based recursion model with a dynamically

allocated per-lane mutex array and take the lane lock

unconditionally.

Add might_sleep() to catch any future atomic-context caller.

Found with the ndctl unit test btt-check.sh. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References