CVE-2026-43358
Received Received - Intake
RCU Locking Issue in Linux Kernel Btrfs

Publication date: 2026-05-08

Last updated on: 2026-05-08

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer() Call rcu_read_lock() before exiting the loop in try_release_subpage_extent_buffer() because there is a rcu_read_unlock() call past the loop. This has been detected by the Clang thread-safety analyzer.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-08
Last Modified
2026-05-08
Generated
2026-06-19
AI Q&A
2026-05-08
EPSS Evaluated
2026-06-18
NVD
CVE-2026-43358
EUVD
EUVD-2026-28664
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

This vulnerability is related to a missing RCU unlock in the Linux kernel's btrfs subsystem, specifically in the try_release_subpage_extent_buffer() function. Detection would typically require analyzing the kernel source code or using static analysis tools like the Clang thread-safety analyzer that originally detected the issue.

There are no specific network or system commands provided to detect this vulnerability directly.

Executive Summary

This vulnerability is in the Linux kernel's btrfs filesystem code. It involves a missing RCU (Read-Copy-Update) unlock call in the error path of the function try_release_subpage_extent_buffer(). Specifically, the function calls rcu_read_lock() before a loop but fails to call rcu_read_unlock() if an error occurs and the loop exits early. This can lead to improper synchronization and potential issues in kernel memory management.

Impact Analysis

The impact of this vulnerability could include kernel instability or memory corruption due to improper handling of RCU locks. This might lead to system crashes or unpredictable behavior when using the btrfs filesystem on affected Linux kernels.

Mitigation Strategies

The vulnerability has been resolved by adding the missing RCU unlock in the error path of the try_release_subpage_extent_buffer() function in the Linux kernel.

Immediate mitigation steps would include updating your Linux kernel to a version that includes this fix.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43358. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart