Executive brief
A vulnerability in the Linux kernel's Btrfs file system can cause a system crash (kernel panic) under specific error conditions. When the file system runs out of space and automatically switches to a protective read-only mode, certain background repair tasks may fail to recognize this change and trigger an internal error. This results in a complete system halt, potentially disrupting operations and requiring a reboot.
Technical details
A race condition or logic error exists in the Btrfs file system's I/O repair path. Specifically, the `btrfs_repair_io_failure()` function contained an `ASSERT()` statement that required the file system not to be in read-only (RO) mode. If a critical error (such as ENOSPC) causes the file system to flip to RO mode while a read-repair is pending, the assertion fails, triggering a kernel panic (BUG_ON/invalid opcode). An attacker or a system under heavy load could trigger this state, leading to a denial of service. The fix replaces the assertion with a graceful return if the file system is detected to be in read-only mode.
Affected products
- Linux Linux Kernel 6.19-rc6
Timeline
- 2026-01-27: patched: Initial patch authored by Qu Wenruo
- 2026-05-08: disclosed: CVE-2026-43299 published