Executive brief
A vulnerability was identified in the Linux kernel's Btrfs file system component. Under specific conditions involving non-consecutive gaps in disk space allocation, the system may incorrectly attempt to allocate overlapping data chunks. This leads to a transaction abort and a system crash (kernel panic), potentially resulting in a denial of service or file system corruption.
Technical details
A logic error exists in the Btrfs 'find_free_dev_extent' function and 'dev_extent_hole_check' utility. When searching for free device extents, the kernel fails to account for multiple non-consecutive 'pending' extents within a single identified hole. The code incorrectly assumes only one pending extent exists and returns a candidate hole that overlaps with subsequent pending extents. This results in an EEXIST error (-17) during 'insert_dev_extents' in 'btrfs_create_pending_block_groups', causing a transaction abort. The issue is most easily triggered during DUP chunk allocations or forced chunk allocations. Patches have been released in the stable kernel branches to correctly iterate through all pending extents in a range.
Affected products
- Linux Linux Kernel 6.19-rc6+
Timeline
- 2026-01-29: patched: Initial fix authored by Boris Burkov
- 2026-05-27: disclosed: CVE-2026-45934 published