CVE-2026-46251: Linux Btrfs EXTENT_TREE_V2 Dirty List Corruption – Local DoS Risk

Technical summary

The vulnerability exists in the Btrfs transaction commit path when EXTENT_TREE_V2 is set. The kernel unconditionally adds the block_group_tree to switch_commits before calling switch_commit_roots, but the block_group_tree uses normal root dirty tracking. When a transaction performs an allocation that dirties the block group, the block_group_root is already linked via its dirty_list field. The subsequent list_add_tail() call corrupts the prev/next pointers. This manifests as list_del corruption warnings when CONFIG_DEBUG_LIST is enabled, and eventually leads to mixed switch_commits and dirty_cowonly_roots lists, causing the kernel to attempt invalid tree lookups and abort transactions with ENOENT errors.

Business impact

Systems running Btrfs with EXTENT_TREE_V2 enabled face filesystem instability and potential data loss. Active workloads experience transaction aborts during sync operations, making the filesystem unreliable for production use. Services dependent on affected storage become unavailable. On systems where Btrfs hosts container storage or virtual machine images, cascading failures can take down infrastructure dependent on that storage layer.

Affected systems

Linux systems running kernel versions with EXTENT_TREE_V2 Btrfs support when that feature is enabled on filesystems. This primarily affects newer kernel releases (6.18 and related development branches) where EXTENT_TREE_V2 is available and actively used. Systems with older kernels are unaffected unless they have backported this feature.

Exploitability

This vulnerability requires local access and cannot be triggered remotely. An unprivileged user cannot directly exploit it; the condition manifests during normal filesystem operations (allocation and sync) on systems with EXTENT_TREE_V2 enabled. No user interaction or special privileges are needed once the condition is met—the bug triggers automatically during typical filesystem workloads. The attack vector is local with low complexity.

Remediation

Apply kernel patches that fix the block_group_tree dirty_list handling. The fix involves preventing the unconditional list_add_tail() operation on the block_group_tree when it is already tracked in the dirty_list. Verify against the vendor advisory for specific patch versions and backport availability for your kernel series. Systems should prioritize patching if EXTENT_TREE_V2 is enabled on production Btrfs filesystems.

Patch guidance

Monitor Linux kernel security advisories and your distribution's errata for patched kernel versions. When patches are available, test in a non-production environment with EXTENT_TREE_V2-enabled Btrfs volumes under load to verify stability. Coordinate kernel updates with your change management process. For enterprise distributions (RHEL, SLES, Ubuntu, etc.), check their security channels for backported fixes even if running older kernel versions. Verify patch application with `uname -r` post-reboot.

Detection guidance

Enable CONFIG_DEBUG_LIST in your kernel if running affected versions to surface list corruption warnings early. Monitor system logs for messages like 'list_del corruption' and 'BTRFS critical unable to find root key'. Check dmesg for transaction abort errors (BTRFS: Transaction aborted) correlated with sync operations. If running EXTENT_TREE_V2 Btrfs filesystems, watch for unexpected filesystem hangs or I/O errors during normal workloads. Use `btrfs filesystem show` to identify which filesystems have EXTENT_TREE_V2 enabled.

Why prioritize this

This receives high priority due to the HIGH CVSS score (8.4) reflecting local root-level impact, combined with the practical severity of filesystem corruption and data loss risk. Although it requires local access, any unprivileged user triggering normal filesystem operations can cause the crash. Production infrastructure relying on Btrfs with this feature enabled faces immediate stability threats. The window between vulnerability and patch is critical for operational risk.

Risk score, explained

CVSS 3.1 8.4 (HIGH) reflects: Attack Vector Local (filesystem-based), Access Complexity Low (no special conditions beyond feature enablement), Privileges None (unprivileged user can trigger), User Interaction None, with high impact on Confidentiality, Integrity, and Availability. The filesystem can leak data during corruption, inconsistent state compromises integrity, and transaction aborts remove availability. The scope is unchanged as it affects the local system only.

Frequently asked questions