CVE-2026-23214
Improper Transaction Handling in Btrfs Causes Data Corruption Risk
Publication date: 2026-02-18
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.10 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 6.12.70 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's btrfs filesystem. It occurs because btrfs allows new transactions to be started even when the filesystem is mounted as read-only. This behavior is normally intended to allow log replay on read-only mounts. However, when the filesystem is mounted with rescue options, it is fully read-only and cannot be remounted as read-write. In this case, new transactions should be rejected but are not, which leads to warnings and errors during unmounting, especially on heavily corrupted filesystems.
The issue manifests as warnings like 'BTRFS: Transaction aborted (error -22)' during unmount, caused by attempts to start new transactions while evicting inodes on a fully read-only filesystem mounted with rescue options.
The fix involves detecting when the filesystem is mounted with rescue options and treating it as an error state that rejects any new transactions.
How can this vulnerability impact me? :
This vulnerability can cause filesystem errors and warnings during unmount operations on btrfs filesystems that are mounted with rescue options and are heavily corrupted. Specifically, it can lead to aborted transactions and potential instability or data integrity issues during the unmount process.
While it does not directly allow unauthorized access or data corruption by itself, the improper handling of transactions on a fully read-only filesystem could complicate recovery efforts or lead to unexpected behavior in system shutdown or filesystem maintenance.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as warnings during unmount of a heavily fuzzed btrfs filesystem mounted with rescue mount options. Specifically, you may observe kernel log messages such as "BTRFS: Transaction aborted (error -22)" along with stack traces related to btrfs transaction handling.
To detect this issue on your system, you can monitor the kernel logs for these specific warnings when unmounting btrfs filesystems.
Suggested commands to check for this vulnerability include:
- Use dmesg or journalctl to review kernel logs for btrfs transaction abort warnings: `dmesg | grep -i btrfs` or `journalctl -k | grep -i btrfs`
- Check mount options of btrfs filesystems to see if rescue mount options are used: `mount | grep btrfs`
- Attempt to unmount btrfs filesystems and observe if warnings appear in kernel logs.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by rejecting new transactions on btrfs filesystems mounted with rescue mount options, treating the filesystem as fully read-only to prevent transaction creation.
Immediate mitigation steps include:
- Avoid mounting btrfs filesystems with rescue mount options unless necessary.
- Apply the updated Linux kernel patch that includes the fix for this issue to ensure that new transactions are rejected on fully read-only btrfs filesystems.
- Monitor kernel logs for any warnings related to btrfs transactions and avoid unmounting corrupted or fuzzed btrfs filesystems without the fix.