Executive brief
A vulnerability in the Linux kernel's Btrfs file system component can cause a system crash when using specific storage configurations like OverlayFS. This issue occurs during file synchronization operations and could lead to a complete denial of service or potential data exposure. Organizations using Btrfs in containerized or layered file system environments are most at risk.
Technical details
A vulnerability exists in the Btrfs tracepoint event 'btrfs_sync_file()' where the kernel incorrectly attempts to retrieve the superblock from a dentry. When OverlayFS is layered on top of Btrfs, 'dentry->d_sb' points to the overlay's superblock rather than the Btrfs superblock, causing an invalid fsid assignment and a subsequent kernel crash. The fix involves using 'file_inode(file)->i_sb' to ensure the correct Btrfs superblock is accessed. While the CVSS vector provided by the CNA indicates a network attack vector, this is typically a local exploitation scenario unless triggered by network-facing services interacting with the file system. Patching is available in various stable kernel branches.
Affected products
- Linux Linux Kernel 4.8 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc5
Timeline
- 2026-05-06: advisory: Initial disclosure and NVD publication
- 2026-06-01: patched: Updated with stable branch patch references
References
- https://git.kernel.org/stable/c/2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a
- https://git.kernel.org/stable/c/32372781d664a9b03c40343e96c29d0a6139f97d
- https://git.kernel.org/stable/c/4a7bab35fad5251c8cb738161152578cd83b6b9c
- https://git.kernel.org/stable/c/520e8b4bcf872a534a7bf61ccf880047642df296
- https://git.kernel.org/stable/c/a85b46db143fda5869e7d8df8f258ccef5fa1719
- https://git.kernel.org/stable/c/c09a7446aab5773f38d6abb25fce99b8e1dfbc97
- https://git.kernel.org/stable/c/d110d7cdb045715c0b45b0dfd974525bb38f653d