Executive brief
A vulnerability in the Linux kernel's Btrfs file system could allow a local user to trigger a system crash. The issue occurs when the system encounters an unexpected data reference type, causing the kernel to halt immediately (a kernel panic). This results in a complete loss of availability for the affected server until it is manually rebooted.
Technical details
A vulnerability exists in the Btrfs implementation within the Linux kernel where the function 'run_one_delayed_ref' uses the BUG() macro when encountering an unexpected delayed reference node type. In Linux kernel development, BUG() triggers a kernel panic, halting the system. An attacker or a corrupted filesystem image could potentially trigger this code path, leading to a local Denial of Service (DoS). The fix replaces the BUG() call with proper error handling, returning -EUCLEAN and logging an error message instead of crashing the system. The vulnerability is reachable via local filesystem operations that interact with the Btrfs extent tree.
Affected products
- Linux Linux Kernel Btrfs file system component
Timeline
- 2026-01-13: other: Patch authored
- 2026-05-08: disclosed: CVE published