Public bug reported:
# Launchpad bug: NULL pointer deref in btree_csum_one_bio during
compressed writeback (btrfs, zstd) — 2nd occurrence, now on a freshly
mkfs'd filesystem
**Summary:**
Kernel oops `btree_csum_one_bio+0x23/0x270 [btrfs]` (NULL deref, RBX=0, read at
offset 0x70) in a btrfs-delalloc worker during submission of compressed
writeback. Routine desktop IO (containers writing to disk, backup agent
running); no defragmentation or other stress. This is the second occurrence on
this hardware: the first was in September 2026 on linux 7.3.0-5 (previous
install), this one on linux 7.3.0-8 — **on a freshly created filesystem after
reinstalling the OS and restoring data from backup**. Not
fs-corruption-dependent.
## Environment
- Ubuntu, linux 7.3.0-8-generic; previous occurrence on 7.3.0-5-generic
- ASRock Z690 Steel Legend, Intel i7-14700K, 48G RAM, 48G swapfile (zswap
enabled, zstd, 20% pool)
- Root fs: btrfs on nvme0n1p3 (fresh mkfs on 2026-10-04), single device, ~950G
- **All btrfs subvolumes mounted with `compress-force=zstd:1`** — every
filesystem write goes through the zstd compressed writeback path, so this code
path is under continuous load
- Concurrent load at crash time: podman containers (health checks), kopia
backup agent, syncthing
## Crash (2026-10-04, uptime 12423 s, kdump vmcore-dmesg attached)
```
BUG: kernel NULL pointer dereference, address: 0000000000000070
#PF: supervisor read access in kernel mode, error_code(0x0000)
Workqueue: btrfs-delalloc btrfs_work_helper [btrfs]
RIP: 0010:btree_csum_one_bio+0x23/0x270 [btrfs]
Call Trace:
btrfs_submit_chunk+0x695/0x6b0 [btrfs]
btrfs_submit_bbio+0x1b/0x30 [btrfs]
submit_one_async_extent+0x22d/0x400 [btrfs]
submit_compressed_extents+0xb7/0x1b0 [btrfs]
run_ordered_work+0x6f/0x240 [btrfs]
btrfs_work_helper+0xe0/0x1e0 [btrfs]
process_one_work / worker_thread / kthread
```
RBX = 0 at the faulting instruction; looks like the compressed-bio context (or
csum object) was NULL/already freed when the csum walker ran — consistent with
a race between ordered-work completion and submission of the async extent.
## Notes
- Same subsystem as a previously reported zstd workspace UAF triggered by
parallel btrfs defragmentation (LP#2169415 — compressed writeback /
btrfs-delalloc workers, kernel zstd), but different fault site: this one is in
the btrfs csum/bio path, not inside the compressor. Filing separately as
requested workflow; maintainers may want to look at both.
- System is configured with panic_on_oops=1 + kdump, so the machine
self-reboots and captures the trace; the oops does not appear in journald by
design.
## Attachments
- /var/crash/202610041749/dmesg.202610041749 (kdump vmcore-dmesg, collected by
apport)
## Request
Please route to fs/btrfs maintainers. Trigger appears to be plain compressed
writeback under moderate concurrent load — reproducible in the field; happy to
test patches.
ProblemType: Bug
DistroRelease: Ubuntu 26.10
Package: linux-image-7.3.0-8-generic 7.3.0-8.8
ProcVersionSignature: Ubuntu 7.3.0-8.8-generic 7.3.0-rc5
Uname: Linux 7.3.0-8-generic x86_64
ApportVersion: 2.36.0-0ubuntu1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: alex 3428 F.... wireplumber
/dev/snd/controlC1: alex 3428 F.... wireplumber
/dev/snd/controlC2: alex 3428 F.... wireplumber
/dev/snd/seq: alex 3426 F.... pipewire
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Sun Oct 4 21:22:27 2026
InstallationDate: Installed on 2026-10-03 (1 days ago)
InstallationMedia: Kubuntu 26.10 "Stonking Stingray" - Beta amd64 (20260929)
IwDevWlp3s0f0Link: Not connected.
MachineType: ASRock Z690 Steel Legend
ProcFB: 0 nvidia-drmdrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.3.0-8-generic
root=UUID=984a3dfc-b31b-4c9e-b1fd-19f0c4b38e9b ro rootflags=subvol=@ quiet
splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 08/09/2024
dmi.bios.release: 5.27
dmi.bios.vendor: American Megatrends International, LLC.
dmi.bios.version: 19.02
dmi.board.name: Z690 Steel Legend
dmi.board.vendor: ASRock
dmi.chassis.asset.tag: To Be Filled By O.E.M.
dmi.chassis.type: 3
dmi.chassis.vendor: To Be Filled By O.E.M.
dmi.chassis.version: To Be Filled By O.E.M.
dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvr19.02:bd08/09/2024:br5.27:svnASRock:pnZ690SteelLegend:pvrToBeFilledByO.E.M.:rvnASRock:rnZ690SteelLegend:rvr:cvnToBeFilledByO.E.M.:ct3:cvrToBeFilledByO.E.M.:skuToBeFilledByO.E.M.:pfaToBeFilledByO.E.M.:
dmi.product.family: To Be Filled By O.E.M.
dmi.product.name: Z690 Steel Legend
dmi.product.sku: To Be Filled By O.E.M.
dmi.product.version: To Be Filled By O.E.M.
dmi.sys.vendor: ASRock
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug stonking wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169493
Title:
NULL pointer deref in btree_csum_one_bio during compressed writeback
(btrfs, zstd) — 2nd occurrence, fresh filesystem
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169493/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
