CVE-2026-43046
Awaiting Analysis Awaiting Analysis - Queue
Heap Buffer Overflow in Btrfs Filesystem

Publication date: 2026-05-01

Last updated on: 2026-05-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: reject root items with drop_progress and zero drop_level [BUG] When recovering relocation at mount time, merge_reloc_root() and btrfs_drop_snapshot() both use BUG_ON(level == 0) to guard against an impossible state: a non-zero drop_progress combined with a zero drop_level in a root_item, which can be triggered: ------------[ cut here ]------------ kernel BUG at fs/btrfs/relocation.c:1545! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 283 ... Tainted: 6.18.0+ #16 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Ubuntu 24.04 PC v2, BIOS 1.16.3-debian-1.16.3-2 RIP: 0010:merge_reloc_root+0x1266/0x1650 fs/btrfs/relocation.c:1545 Code: ffff0000 00004589 d7e9acfa ffffe8a1 79bafebe 02000000 Call Trace: merge_reloc_roots+0x295/0x890 fs/btrfs/relocation.c:1861 btrfs_recover_relocation+0xd6e/0x11d0 fs/btrfs/relocation.c:4195 btrfs_start_pre_rw_mount+0xa4d/0x1810 fs/btrfs/disk-io.c:3130 open_ctree+0x5824/0x5fe0 fs/btrfs/disk-io.c:3640 btrfs_fill_super fs/btrfs/super.c:987 [inline] btrfs_get_tree_super fs/btrfs/super.c:1951 [inline] btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline] btrfs_get_tree+0x111c/0x2190 fs/btrfs/super.c:2128 vfs_get_tree+0x9a/0x370 fs/super.c:1758 fc_mount fs/namespace.c:1199 [inline] do_new_mount_fc fs/namespace.c:3642 [inline] do_new_mount fs/namespace.c:3718 [inline] path_mount+0x5b8/0x1ea0 fs/namespace.c:4028 do_mount fs/namespace.c:4041 [inline] __do_sys_mount fs/namespace.c:4229 [inline] __se_sys_mount fs/namespace.c:4206 [inline] __x64_sys_mount+0x282/0x320 fs/namespace.c:4206 ... RIP: 0033:0x7f969c9a8fde Code: 0f1f4000 48c7c2b0 fffffff7 d8648902 b8ffffff ffc3660f ---[ end trace 0000000000000000 ]--- The bug is reproducible on 7.0.0-rc2-next-20260310 with our dynamic metadata fuzzing tool that corrupts btrfs metadata at runtime. [CAUSE] A non-zero drop_progress.objectid means an interrupted btrfs_drop_snapshot() left a resume point on disk, and in that case drop_level must be greater than 0 because the checkpoint is only saved at internal node levels. Although this invariant is enforced when the kernel writes the root item, it is not validated when the root item is read back from disk. That allows on-disk corruption to provide an invalid state with drop_progress.objectid != 0 and drop_level == 0. When relocation recovery later processes such a root item, merge_reloc_root() reads drop_level and hits BUG_ON(level == 0). The same invalid metadata can also trigger the corresponding BUG_ON() in btrfs_drop_snapshot(). [FIX] Fix this by validating the root_item invariant in tree-checker when reading root items from disk: if drop_progress.objectid is non-zero, drop_level must also be non-zero. Reject such malformed metadata with -EUCLEAN before it reaches merge_reloc_root() or btrfs_drop_snapshot() and triggers the BUG_ON. After the fix, the same corruption is correctly rejected by tree-checker and the BUG_ON is no longer triggered.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-01
Last Modified
2026-05-01
Generated
2026-05-07
AI Q&A
2026-05-01
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux kernel 7.0.0-rc2-next-20260310
linux linux_kernel 7.0.0-rc2-next-20260310
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's btrfs filesystem. It involves improper validation of certain metadata fields called drop_progress and drop_level in root items during mount time relocation recovery.

Specifically, when recovering relocation at mount time, the kernel expects that if drop_progress.objectid is non-zero (indicating an interrupted snapshot drop operation), then drop_level must also be non-zero. However, this invariant was not validated when reading root items from disk, allowing corrupted metadata with drop_progress.objectid != 0 and drop_level == 0 to exist.

This invalid state triggers a kernel BUG (crash) in functions merge_reloc_root() and btrfs_drop_snapshot() because they use BUG_ON(level == 0) to guard against this impossible state.

The fix involves adding validation in the tree-checker to reject such malformed metadata before it causes a kernel crash.


How can this vulnerability impact me? :

This vulnerability can cause the Linux kernel to crash (kernel BUG) during the mount process of a btrfs filesystem if corrupted metadata is present.

Such crashes can lead to system instability, potential data loss, or denial of service because the filesystem cannot be mounted properly.

The issue arises from corrupted or malformed on-disk metadata that violates expected invariants, which could be triggered unintentionally by disk corruption or potentially by an attacker who can manipulate the filesystem metadata.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability is fixed by validating the root_item invariant in the tree-checker when reading root items from disk. Specifically, if drop_progress.objectid is non-zero, drop_level must also be non-zero. Malformed metadata with a non-zero drop_progress.objectid and zero drop_level is rejected with -EUCLEAN before it can trigger the kernel BUG_ON conditions.

Therefore, the immediate mitigation step is to update the Linux kernel to a version that includes this fix, which ensures corrupted btrfs metadata is detected and rejected early, preventing the BUG_ON crash.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The provided information about the vulnerability CVE-2026-43046 does not include any details regarding its impact on compliance with common standards and regulations such as GDPR or HIPAA.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability manifests as a kernel BUG triggered by invalid btrfs metadata during mount time, specifically when recovering relocation. Detection involves monitoring for kernel BUG messages related to btrfs, such as those containing 'kernel BUG at fs/btrfs/relocation.c:1545' or 'BUG_ON(level == 0)'.

You can check your system logs (e.g., using dmesg or journalctl) for such kernel BUG messages indicating this issue.

  • dmesg | grep -i 'btrfs.*BUG_ON'
  • journalctl -k | grep -i 'btrfs.*BUG_ON'

Additionally, since the issue relates to corrupted btrfs root items with invalid drop_progress and drop_level fields, running btrfs filesystem checks or tree-checker tools that validate root items could help detect malformed metadata before mount.

However, no specific commands or tools are provided in the available information to directly detect this vulnerability beyond monitoring for kernel BUG messages during mount or filesystem operations.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart