Junglewise Threat Intelligence

CVE-2026-23141: Linux kernel Btrfs invalid memory access in send operation

CVE-2026-23141 · Severity: medium · CVSS 5.5 · Published 2026-02-14

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Btrfs file system could allow a local user to cause a system crash or access unintended internal data. The issue occurs during specific file operations (incremental send) when handling very small files stored directly within the file system's structural metadata. This could lead to service disruptions or instability on affected Linux systems.

Technical details

A vulnerability in the Btrfs 'send' component of the Linux kernel arises from a missing check for inline extents in the 'range_is_hole_in_parent()' function. In Btrfs, inline extents store data at the same offset where the 'disk_bytenr' field is normally located for regular files. If the inline data is smaller than 8 bytes, the kernel may perform an invalid memory access when attempting to read 'disk_bytenr', or it may inadvertently read metadata from adjacent items in the leaf node. This can be triggered by a local user with sufficient privileges to initiate a Btrfs send operation, resulting in a denial of service (system crash) or information leakage from other metadata items. Patches have been released for various stable kernel branches including 6.6.y, 6.12.y, and 6.18.y.

Affected products

  • Linux Linux kernel 4.11 to 6.6.122, 6.7 to 6.12.67, 6.13 to 6.18.7, 6.19-rc1 to 6.19-rc5

Timeline

  • 2026-01-09: patched: Initial fix committed to mainline kernel tree.
  • 2026-02-14: disclosed: CVE-2026-23141 published.

References

Related threats