Executive brief
A vulnerability in the Linux kernel's Btrfs file system allows a local user to crash the file system, forcing it into a read-only state. By repeatedly using a specific file system command (ioctl) on subvolumes they own, a user can trigger a metadata overflow that halts all write operations. This results in a denial of service for any applications or users relying on the affected file system.
Technical details
A vulnerability exists in the Btrfs 'set received' ioctl (BTRFS_IOC_SET_RECEIVED_SUBVOL) due to improper handling of item overflows in the UUID tree. When attempting to add a BTRFS_UUID_KEY_RECEIVED_SUBVOL, if the metadata item exceeds the maximum leaf size, the kernel triggers a transaction abort. Because this occurs after metadata updates have already begun, the filesystem is forced into read-only mode to maintain consistency. A local attacker owning a subvolume can exploit this without CAP_SYS_ADMIN privileges by repeatedly calling the ioctl with the same UUID across many subvolumes. The fix introduces an early check for potential overflow using btrfs_uuid_tree_check_overflow() before the transaction starts.
Affected products
- Linux Linux Kernel 3.12 and later
Timeline
- 2026-02-26: other: Patch authored
- 2026-03-03: patched: Patch committed to mainline kernel
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2e57b8cac2ba0d38aac76c1ecdfd8b899e3581a5
- https://git.kernel.org/stable/c/41fb97353ff58fa4f31904c343fc8e3df2f7517d
- https://git.kernel.org/stable/c/87f2c46003fce4d739138aab4af1942b1afdadac
- https://git.kernel.org/stable/c/b19c0465e4daad5aa8f60552ea0578cf31a11b1e
- https://git.kernel.org/stable/c/b9914db13ac15aca3b74544c0bb1a2e0dad1f174
- https://git.kernel.org/stable/c/d11aefe654a04fc41996d254748d6a38b6b0a7be