Executive brief
A vulnerability in the Linux kernel's Btrfs file system could lead to data corruption or system errors following a power failure. The issue occurs when a directory is deleted while a program still has it open; if the system crashes shortly after, the file system's internal logs may become inconsistent. This can prevent the file system from mounting correctly or result in 'corrupt leaf' errors during recovery, potentially impacting system availability and data integrity.
Technical details
A logic error exists in the Btrfs file system driver where the 'last_unlink_trans' field is not updated during directory removal. If a process holds an open file descriptor to a directory, performs an rmdir, and then executes an fsync on that descriptor, the file system log may record inconsistent state. In the event of a power failure or system crash before the transaction is fully committed to disk, the subsequent log replay during mount will detect an invalid number of links (nlink) for the directory. This results in a 'corrupt leaf' error and a failed mount (-EIO), requiring manual file system repair. The fix ensures the transaction generation is correctly tracked during unlinking.
Affected products
- Linux Linux Kernel Btrfs file system component
Timeline
- 2026-04-09: patched: Initial patch authored by Filipe Manana
- 2026-05-28: disclosed: CVE published to NVD dataset
References
- https://git.kernel.org/stable/c/36fcc2c7517f8a86379154c9793f867592aa8b7e
- https://git.kernel.org/stable/c/999757231c49376cd1a37308d2c8c4c9932571e1
- https://git.kernel.org/stable/c/aa9c3ecaf7337df3a689318584f879b5339ede0f
- https://git.kernel.org/stable/c/cc3c0a0f965754ce230d93ba44ee5b34fbe6138a
- https://git.kernel.org/stable/c/fb388eb58c1ba047ccabc33901839acfecadcf49