Executive brief
A vulnerability in the Btrfs file system of the Linux kernel allows a local user to crash the file system, forcing it into a read-only state. By repeatedly creating snapshots of a specific type of subvolume, a user can trigger an internal data overflow that halts file system operations. This can lead to a denial-of-service condition where the system can no longer write data to the affected disk, potentially disrupting services and applications.
Technical details
A vulnerability exists in the Btrfs implementation within the Linux kernel where snapshotting a previously received subvolume multiple times can lead to a BTRFS_UUID_KEY_RECEIVED_SUBVOL item overflow. This overflow occurs when the maximum item size in a B-tree leaf is exceeded during the insertion of UUID items. Because the snapshot and subvolume management operations do not require CAP_SYS_ADMIN (only inode ownership or equivalent capabilities), a local unprivileged user can exploit this to trigger a transaction abort (errno -75, EOVERFLOW). The resulting failure forces the filesystem into a read-only (RO) state to maintain consistency, causing a denial of service for write operations. The fix involves ignoring non-critical EOVERFLOW errors during the UUID tree update in the snapshot creation path.
Affected products
- Linux Linux Kernel 6.19.0-rc8-btrfs-next-225+
Timeline
- 2026-02-23: patched: Initial patch authored
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/6bce705b699cba9afccb996c77d194fe003dfa2a
- https://git.kernel.org/stable/c/770af8e465c2c3de528f85e840eab462dd41542b
- https://git.kernel.org/stable/c/9a9227b488ffb7cdbb5d930a01fc6956c05ba61a
- https://git.kernel.org/stable/c/bac55dde8efa457e769c934fd88a63f2141ba238
- https://git.kernel.org/stable/c/e1b18b959025e6b5dbad668f391f65d34b39595a
- https://git.kernel.org/stable/c/e3d8efc157bc590457d3e31da403af1a221643d6