Executive brief
A vulnerability in the Btrfs file system component of the Linux kernel allows a standard user to crash the file system. By creating a specific set of files with names that cause internal data collisions, an attacker can force the file system into a 'read-only' mode. This results in a denial-of-service where no new data can be written to the disk until the system is recovered.
Technical details
A vulnerability in `btrfs_create_new_inode` within the Btrfs file system driver allows for a transaction abort (error -75, EOVERFLOW) when multiple filenames result in the same CRC32C hash. Btrfs attempts to pack directory items with the same hash into the same leaf; if the number of collisions exceeds the inherent leaf size limit, the kernel triggers a transaction abort. This abort forces the entire filesystem into read-only (RO) mode to prevent corruption. A local unprivileged user can exploit this by creating a large number of files with colliding names, leading to a system-wide denial of service for write operations. The issue has been resolved in the stable kernel tree.
Affected products
- Linux Linux Kernel 6.19.0-rc8-btrfs-next-225+ and earlier
Timeline
- 2026-02-26: patched: Fix authored by Filipe Manana
- 2026-05-08: disclosed: CVE-2026-43360 published
References
- https://git.kernel.org/stable/c/0625e564290450c1921b115fc3d9abef74e055bd
- https://git.kernel.org/stable/c/2d1ababdedd4ba38867c2500eb7f95af5ddeeef7
- https://git.kernel.org/stable/c/36947b5200b89bbe3a63629c12d4b31c84c0af9f
- https://git.kernel.org/stable/c/5e2ea10b800d1bbb95e0c01a83f4f8119ac5d688
- https://git.kernel.org/stable/c/64ad49597d14c495ab8b7933bfefc83936a598e4
- https://git.kernel.org/stable/c/9273175bf16c83f3ec93aa242d78c9b5db452d4d