CVE-2026-43360
Transaction Abort in Linux Kernel Btrfs
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in the Linux kernel's btrfs filesystem causes a transaction abort and switches the filesystem to read-only mode when multiple files with names resulting in the same hash are created, potentially allowing a malicious user to disrupt the system without administrative privileges.
Immediate mitigation steps should include updating the Linux kernel to a version where this vulnerability has been fixed.
Until an update is applied, avoid creating multiple files with names that could cause hash collisions in btrfs filesystems to prevent triggering the transaction abort.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's btrfs filesystem. When multiple files are created with names that produce the same hash value, they must be stored together in the same directory item, which has a size limit. If this limit is exceeded due to too many hash collisions, it triggers a transaction abort.
As a result of this transaction abort, the filesystem switches to read-only mode, preventing further writes.
A malicious user without administrative privileges can exploit this by creating many files with colliding hashes, causing disruption by making the filesystem read-only.
How can this vulnerability impact me? :
The vulnerability can disrupt system operations by forcing the btrfs filesystem into read-only mode when triggered.
This means users and applications will be unable to write data to the filesystem, potentially causing service interruptions or data processing failures.
Since the exploit does not require administrative privileges, any user with write access to the filesystem could cause this disruption.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the issue using a script that creates multiple files with names resulting in the same hash in a btrfs filesystem. The provided reproducer script exploit-hash-collisions.sh demonstrates this by formatting a device with a small node size, mounting it, and then creating files with specific names that cause hash collisions.
The key commands involved in detection are:
- mkfs.btrfs -f --nodesize 4K /dev/sdi # Format the device with a small node size
- mount /dev/sdi /mnt/sdi # Mount the device
- Run a script that creates multiple files with names that produce the same crc32c hash to trigger the issue.
If the limit inherent to the leaf size is reached, the filesystem will abort the transaction and turn into read-only mode, indicating the presence of the vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a malicious user without administrative privileges to disrupt a Linux system by causing the filesystem to become read-only. Such disruption could potentially impact system availability.
However, there is no specific information provided about how this vulnerability directly affects compliance with common standards and regulations such as GDPR or HIPAA.