Executive brief
A vulnerability was identified in the Linux kernel's Btrfs file system during the process of enabling storage quotas. If the system encounters an unexpected state while searching for internal data, it could attempt to access invalid memory locations. This could lead to a system crash or instability, potentially impacting the availability of services relying on Btrfs storage.
Technical details
A vulnerability in the Btrfs quota management component (fs/btrfs/qgroup.c) occurs when btrfs_search_slot_for_read() returns 1, indicating the end of the tree has been reached. In this scenario, the code previously continued execution and attempted to access an invalid path/leaf. This is a logic error where the search loop failed to terminate upon reaching the end of the B-tree. An attacker or a specific system state could trigger this invalid memory access, leading to a kernel oops or denial of service. The fix replaces a 'continue' statement with a 'break' to properly exit the loop when the search fails to find a valid key.
Affected products
- Linux Linux kernel btrfs filesystem
Timeline
- 2026-02-04: other: Patch authored by Filipe Manana
- 2026-05-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/023545e272f369d487e6a986c1e321c6e04be1da
- https://git.kernel.org/stable/c/0761447f6f51e1c7997960d8e6559337deed6729
- https://git.kernel.org/stable/c/1ee1d006c9fe4d6be5527ab1c84216b80cccbe40
- https://git.kernel.org/stable/c/b2bd557b75b760e4b9d209112bda19314bd64558
- https://git.kernel.org/stable/c/b5b8ade9da452086e78f5d519b90d3769e354853
- https://git.kernel.org/stable/c/d7cf2314dd5e8661c05d076cd627eea9a7f76616
- https://git.kernel.org/stable/c/ecb7c2484cfc83a93658907580035a8adf1e0a92