Executive brief
A memory leak vulnerability was identified in the Linux kernel's Btrfs file system component. This issue occurs when the system fails to properly release memory during certain error conditions while mapping data blocks. If exploited, a local user could potentially cause a system slowdown or crash by exhausting available system memory.
Technical details
A memory leak (CWE-401) exists in the Btrfs file system within the btrfs_map_block() function. The vulnerability is triggered when the function performs a chunk map lookup but returns an early -EINVAL error (specifically when the requested mirror number exceeds the available copies) without properly releasing the reference to the looked-up chunk map. This flaw allows a local attacker with low privileges to repeatedly trigger the leak, leading to kernel memory exhaustion and a Denial of Service (DoS). The issue has been resolved by ensuring the code jumps to the 'out' label to properly free the map before returning.
Affected products
- Linux Linux Kernel 6.12 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1, 7.0-rc2
Timeline
- 2026-02-20: other: Patch authored
- 2026-05-08: disclosed: CVE published
- 2026-05-26: advisory: NVD analysis completed