CVE-2026-46159

Technical summary

CVE-2026-46159 is a time-of-check-time-of-use (TOCTOU) race condition in btrfs_ioctl_space_info(). The vulnerability occurs because the function performs two separate passes over block group RAID type lists without holding appropriate synchronization: a first pass counts entries to allocate a buffer, and a second pass fills that buffer. The groups_sem rwlock is released between passes, creating a window during which concurrent block group removal can reduce the actual entry count. When the second pass fills fewer entries than counted in the first pass, the subsequent copy_to_user() call transmits the full buffer size including uninitialized trailing bytes—leaking kernel heap memory to userspace. The fix involves copying only the actual filled count rather than the pre-allocated size, combined with using kzalloc for zeroed allocation to prevent future similar leaks.

Business impact

This information disclosure vulnerability allows local attackers to read sensitive kernel memory that may contain cryptographic keys, authentication tokens, or other confidential data residing on the heap. In multi-tenant container or virtualization environments, this could facilitate privilege escalation or lateral movement. The impact is confined to local attackers and requires specific ioctl invocation patterns, but the nature of heap memory leaks makes the exact sensitive data exposure unpredictable and potentially severe. Organizations running btrfs on systems with untrusted local users face elevated risk.

Affected systems

All versions of the Linux kernel using the btrfs filesystem driver are potentially affected. This includes systems where btrfs is compiled as a module or built into the kernel, regardless of whether actively in use. Enterprise deployments of Linux with btrfs for storage pools, container hosts using btrfs backend drivers, and specialized storage appliances are most commonly affected. The vulnerability requires local code execution capability; remote exploitation is not possible.

Exploitability

Exploitation requires local user-level access to a system running btrfs and the ability to execute the vulnerable ioctl. While no public exploit is known to be in active use, the technical barrier is low—a malicious local user can repeatedly trigger the ioctl under varying concurrency conditions to harvest leaked kernel memory. The race condition window is narrow but achievable through persistent attempts. This is not remotely exploitable and does not grant kernel code execution; it is purely an information disclosure channel.

Remediation

Apply kernel patches that fix the TOCTOU race by: (1) removing the synchronization gap between counting and filling the space info buffer, (2) ensuring copy_to_user() copies only the actual number of filled entries rather than the preallocated size, and (3) using kzalloc instead of kmalloc to zero-initialize the buffer. Systems should update the Linux kernel to a version containing this fix. Until patching is possible, restrict ioctl access via LSM policies or disable btrfs on systems where it is not essential.

Patch guidance

Consult the Linux kernel security advisory and your distribution's kernel update channel for the specific patched version. Verify the patch commit message mentions the TOCTOU race fix in btrfs_ioctl_space_info() and confirms the use of kzalloc and corrected copy size. Most major distributions (Red Hat, Ubuntu, Debian, SUSE) have released or will release kernel updates addressing this vulnerability. Test patches in non-production environments before deployment, particularly for storage-critical systems. Review btrfs usage across your infrastructure to prioritize systems for patching.

Detection guidance

Monitor for unusual btrfs ioctl activity (BTRFS_IOC_SPACE_INFO) via audit logs or eBPF-based tracing. While the vulnerability itself leaves limited artifacts, patterns of repeated rapid ioctl calls may indicate exploitation attempts. System log analysis for memory access violations or warnings from address sanitizers can help in development and test environments. Host-based detection is challenging because the leak is silent; focus on kernel version inventory and patch compliance scanning.

Why prioritize this

Although classified as MEDIUM severity (CVSS 4.7), this vulnerability should be prioritized for patching in environments where btrfs is actively used and local user accounts exist. The information disclosure channel, while not directly enabling privilege escalation, can facilitate attacks in multi-stage campaigns. Organizations with strict data confidentiality requirements, those handling cryptographic material on btrfs volumes, or those in regulated industries should treat this as higher priority. Systems with btrfs disabled or on airgapped networks can be deprioritized.

Risk score, explained

The CVSS 4.7 MEDIUM score reflects: (1) Low attack vector (local only), (2) High attack complexity due to race condition timing requirements, (3) Low privilege requirement (unprivileged user sufficient), (4) No impact on integrity or availability (information disclosure only), but (5) Confidentiality impact from kernel memory exposure. The score appropriately captures the practical risk for most deployments while acknowledging the severity for sensitive environments. Risk context increases significantly in multi-tenant scenarios or systems handling secrets.

Frequently asked questions