CVE-2026-43046 (GCVE-0-2026-43046)

Vulnerability from cvelistv5 – Published: 2026-05-01 14:15 – Updated: 2026-05-02 06:14
VLAI?
Title
btrfs: reject root items with drop_progress and zero drop_level
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: reject root items with drop_progress and zero drop_level [BUG] When recovering relocation at mount time, merge_reloc_root() and btrfs_drop_snapshot() both use BUG_ON(level == 0) to guard against an impossible state: a non-zero drop_progress combined with a zero drop_level in a root_item, which can be triggered: ------------[ cut here ]------------ kernel BUG at fs/btrfs/relocation.c:1545! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 283 ... Tainted: 6.18.0+ #16 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Ubuntu 24.04 PC v2, BIOS 1.16.3-debian-1.16.3-2 RIP: 0010:merge_reloc_root+0x1266/0x1650 fs/btrfs/relocation.c:1545 Code: ffff0000 00004589 d7e9acfa ffffe8a1 79bafebe 02000000 Call Trace: merge_reloc_roots+0x295/0x890 fs/btrfs/relocation.c:1861 btrfs_recover_relocation+0xd6e/0x11d0 fs/btrfs/relocation.c:4195 btrfs_start_pre_rw_mount+0xa4d/0x1810 fs/btrfs/disk-io.c:3130 open_ctree+0x5824/0x5fe0 fs/btrfs/disk-io.c:3640 btrfs_fill_super fs/btrfs/super.c:987 [inline] btrfs_get_tree_super fs/btrfs/super.c:1951 [inline] btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline] btrfs_get_tree+0x111c/0x2190 fs/btrfs/super.c:2128 vfs_get_tree+0x9a/0x370 fs/super.c:1758 fc_mount fs/namespace.c:1199 [inline] do_new_mount_fc fs/namespace.c:3642 [inline] do_new_mount fs/namespace.c:3718 [inline] path_mount+0x5b8/0x1ea0 fs/namespace.c:4028 do_mount fs/namespace.c:4041 [inline] __do_sys_mount fs/namespace.c:4229 [inline] __se_sys_mount fs/namespace.c:4206 [inline] __x64_sys_mount+0x282/0x320 fs/namespace.c:4206 ... RIP: 0033:0x7f969c9a8fde Code: 0f1f4000 48c7c2b0 fffffff7 d8648902 b8ffffff ffc3660f ---[ end trace 0000000000000000 ]--- The bug is reproducible on 7.0.0-rc2-next-20260310 with our dynamic metadata fuzzing tool that corrupts btrfs metadata at runtime. [CAUSE] A non-zero drop_progress.objectid means an interrupted btrfs_drop_snapshot() left a resume point on disk, and in that case drop_level must be greater than 0 because the checkpoint is only saved at internal node levels. Although this invariant is enforced when the kernel writes the root item, it is not validated when the root item is read back from disk. That allows on-disk corruption to provide an invalid state with drop_progress.objectid != 0 and drop_level == 0. When relocation recovery later processes such a root item, merge_reloc_root() reads drop_level and hits BUG_ON(level == 0). The same invalid metadata can also trigger the corresponding BUG_ON() in btrfs_drop_snapshot(). [FIX] Fix this by validating the root_item invariant in tree-checker when reading root items from disk: if drop_progress.objectid is non-zero, drop_level must also be non-zero. Reject such malformed metadata with -EUCLEAN before it reaches merge_reloc_root() or btrfs_drop_snapshot() and triggers the BUG_ON. After the fix, the same corruption is correctly rejected by tree-checker and the BUG_ON is no longer triggered.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9f3a742736cecda5a8778be70faa2f779458839f , < bedaf7d0b9d793e116f16b4d9a7dbc94bcc80443 (git)
Affected: 9f3a742736cecda5a8778be70faa2f779458839f , < ac68a9a8e481ab1becaed29d6d23087dac3de15d (git)
Affected: 9f3a742736cecda5a8778be70faa2f779458839f , < 295f8075d00442d71dc9ccae421ace1c0d2d9224 (git)
Affected: 9f3a742736cecda5a8778be70faa2f779458839f , < 53ceedd1eb6280ca8359664e0226983eded2ed73 (git)
Affected: 9f3a742736cecda5a8778be70faa2f779458839f , < 850de3d87f4720b71ccdcd44f4aa57e46b53a3f3 (git)
Affected: 9f3a742736cecda5a8778be70faa2f779458839f , < de585ee18dd5601745f65a60fef7b7ceebd78c83 (git)
Affected: 9f3a742736cecda5a8778be70faa2f779458839f , < b17b79ff896305fd74980a5f72afec370ee88ca4 (git)
Create a notification for this product.
    Linux Linux Affected: 2.6.29
Unaffected: 0 , < 2.6.29 (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.168 , ≤ 6.1.* (semver)
Unaffected: 6.6.134 , ≤ 6.6.* (semver)
Unaffected: 6.12.81 , ≤ 6.12.* (semver)
Unaffected: 6.18.22 , ≤ 6.18.* (semver)
Unaffected: 6.19.12 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/tree-checker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bedaf7d0b9d793e116f16b4d9a7dbc94bcc80443",
              "status": "affected",
              "version": "9f3a742736cecda5a8778be70faa2f779458839f",
              "versionType": "git"
            },
            {
              "lessThan": "ac68a9a8e481ab1becaed29d6d23087dac3de15d",
              "status": "affected",
              "version": "9f3a742736cecda5a8778be70faa2f779458839f",
              "versionType": "git"
            },
            {
              "lessThan": "295f8075d00442d71dc9ccae421ace1c0d2d9224",
              "status": "affected",
              "version": "9f3a742736cecda5a8778be70faa2f779458839f",
              "versionType": "git"
            },
            {
              "lessThan": "53ceedd1eb6280ca8359664e0226983eded2ed73",
              "status": "affected",
              "version": "9f3a742736cecda5a8778be70faa2f779458839f",
              "versionType": "git"
            },
            {
              "lessThan": "850de3d87f4720b71ccdcd44f4aa57e46b53a3f3",
              "status": "affected",
              "version": "9f3a742736cecda5a8778be70faa2f779458839f",
              "versionType": "git"
            },
            {
              "lessThan": "de585ee18dd5601745f65a60fef7b7ceebd78c83",
              "status": "affected",
              "version": "9f3a742736cecda5a8778be70faa2f779458839f",
              "versionType": "git"
            },
            {
              "lessThan": "b17b79ff896305fd74980a5f72afec370ee88ca4",
              "status": "affected",
              "version": "9f3a742736cecda5a8778be70faa2f779458839f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/tree-checker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reject root items with drop_progress and zero drop_level\n\n[BUG]\nWhen recovering relocation at mount time, merge_reloc_root() and\nbtrfs_drop_snapshot() both use BUG_ON(level == 0) to guard against\nan impossible state: a non-zero drop_progress combined with a zero\ndrop_level in a root_item, which can be triggered:\n\n------------[ cut here ]------------\nkernel BUG at fs/btrfs/relocation.c:1545!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nCPU: 1 UID: 0 PID: 283 ... Tainted: 6.18.0+ #16 PREEMPT(voluntary)\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: QEMU Ubuntu 24.04 PC v2, BIOS 1.16.3-debian-1.16.3-2\nRIP: 0010:merge_reloc_root+0x1266/0x1650 fs/btrfs/relocation.c:1545\nCode: ffff0000 00004589 d7e9acfa ffffe8a1 79bafebe 02000000\nCall Trace:\n merge_reloc_roots+0x295/0x890 fs/btrfs/relocation.c:1861\n btrfs_recover_relocation+0xd6e/0x11d0 fs/btrfs/relocation.c:4195\n btrfs_start_pre_rw_mount+0xa4d/0x1810 fs/btrfs/disk-io.c:3130\n open_ctree+0x5824/0x5fe0 fs/btrfs/disk-io.c:3640\n btrfs_fill_super fs/btrfs/super.c:987 [inline]\n btrfs_get_tree_super fs/btrfs/super.c:1951 [inline]\n btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline]\n btrfs_get_tree+0x111c/0x2190 fs/btrfs/super.c:2128\n vfs_get_tree+0x9a/0x370 fs/super.c:1758\n fc_mount fs/namespace.c:1199 [inline]\n do_new_mount_fc fs/namespace.c:3642 [inline]\n do_new_mount fs/namespace.c:3718 [inline]\n path_mount+0x5b8/0x1ea0 fs/namespace.c:4028\n do_mount fs/namespace.c:4041 [inline]\n __do_sys_mount fs/namespace.c:4229 [inline]\n __se_sys_mount fs/namespace.c:4206 [inline]\n __x64_sys_mount+0x282/0x320 fs/namespace.c:4206\n ...\nRIP: 0033:0x7f969c9a8fde\nCode: 0f1f4000 48c7c2b0 fffffff7 d8648902 b8ffffff ffc3660f\n---[ end trace 0000000000000000 ]---\n\nThe bug is reproducible on 7.0.0-rc2-next-20260310 with our dynamic\nmetadata fuzzing tool that corrupts btrfs metadata at runtime.\n\n[CAUSE]\nA non-zero drop_progress.objectid means an interrupted\nbtrfs_drop_snapshot() left a resume point on disk, and in that case\ndrop_level must be greater than 0 because the checkpoint is only\nsaved at internal node levels.\n\nAlthough this invariant is enforced when the kernel writes the root\nitem, it is not validated when the root item is read back from disk.\nThat allows on-disk corruption to provide an invalid state with\ndrop_progress.objectid != 0 and drop_level == 0.\n\nWhen relocation recovery later processes such a root item,\nmerge_reloc_root() reads drop_level and hits BUG_ON(level == 0). The\nsame invalid metadata can also trigger the corresponding BUG_ON() in\nbtrfs_drop_snapshot().\n\n[FIX]\nFix this by validating the root_item invariant in tree-checker when\nreading root items from disk: if drop_progress.objectid is non-zero,\ndrop_level must also be non-zero. Reject such malformed metadata with\n-EUCLEAN before it reaches merge_reloc_root() or btrfs_drop_snapshot()\nand triggers the BUG_ON.\n\nAfter the fix, the same corruption is correctly rejected by tree-checker\nand the BUG_ON is no longer triggered."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-02T06:14:31.818Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bedaf7d0b9d793e116f16b4d9a7dbc94bcc80443"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac68a9a8e481ab1becaed29d6d23087dac3de15d"
        },
        {
          "url": "https://git.kernel.org/stable/c/295f8075d00442d71dc9ccae421ace1c0d2d9224"
        },
        {
          "url": "https://git.kernel.org/stable/c/53ceedd1eb6280ca8359664e0226983eded2ed73"
        },
        {
          "url": "https://git.kernel.org/stable/c/850de3d87f4720b71ccdcd44f4aa57e46b53a3f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/de585ee18dd5601745f65a60fef7b7ceebd78c83"
        },
        {
          "url": "https://git.kernel.org/stable/c/b17b79ff896305fd74980a5f72afec370ee88ca4"
        }
      ],
      "title": "btrfs: reject root items with drop_progress and zero drop_level",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43046",
    "datePublished": "2026-05-01T14:15:41.849Z",
    "dateReserved": "2026-05-01T14:12:55.979Z",
    "dateUpdated": "2026-05-02T06:14:31.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43046",
      "date": "2026-05-04",
      "epss": "0.00024",
      "percentile": "0.06795"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43046\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-01T15:16:50.933\",\"lastModified\":\"2026-05-01T15:24:14.893\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: reject root items with drop_progress and zero drop_level\\n\\n[BUG]\\nWhen recovering relocation at mount time, merge_reloc_root() and\\nbtrfs_drop_snapshot() both use BUG_ON(level == 0) to guard against\\nan impossible state: a non-zero drop_progress combined with a zero\\ndrop_level in a root_item, which can be triggered:\\n\\n------------[ cut here ]------------\\nkernel BUG at fs/btrfs/relocation.c:1545!\\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\\nCPU: 1 UID: 0 PID: 283 ... Tainted: 6.18.0+ #16 PREEMPT(voluntary)\\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\\nHardware name: QEMU Ubuntu 24.04 PC v2, BIOS 1.16.3-debian-1.16.3-2\\nRIP: 0010:merge_reloc_root+0x1266/0x1650 fs/btrfs/relocation.c:1545\\nCode: ffff0000 00004589 d7e9acfa ffffe8a1 79bafebe 02000000\\nCall Trace:\\n merge_reloc_roots+0x295/0x890 fs/btrfs/relocation.c:1861\\n btrfs_recover_relocation+0xd6e/0x11d0 fs/btrfs/relocation.c:4195\\n btrfs_start_pre_rw_mount+0xa4d/0x1810 fs/btrfs/disk-io.c:3130\\n open_ctree+0x5824/0x5fe0 fs/btrfs/disk-io.c:3640\\n btrfs_fill_super fs/btrfs/super.c:987 [inline]\\n btrfs_get_tree_super fs/btrfs/super.c:1951 [inline]\\n btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline]\\n btrfs_get_tree+0x111c/0x2190 fs/btrfs/super.c:2128\\n vfs_get_tree+0x9a/0x370 fs/super.c:1758\\n fc_mount fs/namespace.c:1199 [inline]\\n do_new_mount_fc fs/namespace.c:3642 [inline]\\n do_new_mount fs/namespace.c:3718 [inline]\\n path_mount+0x5b8/0x1ea0 fs/namespace.c:4028\\n do_mount fs/namespace.c:4041 [inline]\\n __do_sys_mount fs/namespace.c:4229 [inline]\\n __se_sys_mount fs/namespace.c:4206 [inline]\\n __x64_sys_mount+0x282/0x320 fs/namespace.c:4206\\n ...\\nRIP: 0033:0x7f969c9a8fde\\nCode: 0f1f4000 48c7c2b0 fffffff7 d8648902 b8ffffff ffc3660f\\n---[ end trace 0000000000000000 ]---\\n\\nThe bug is reproducible on 7.0.0-rc2-next-20260310 with our dynamic\\nmetadata fuzzing tool that corrupts btrfs metadata at runtime.\\n\\n[CAUSE]\\nA non-zero drop_progress.objectid means an interrupted\\nbtrfs_drop_snapshot() left a resume point on disk, and in that case\\ndrop_level must be greater than 0 because the checkpoint is only\\nsaved at internal node levels.\\n\\nAlthough this invariant is enforced when the kernel writes the root\\nitem, it is not validated when the root item is read back from disk.\\nThat allows on-disk corruption to provide an invalid state with\\ndrop_progress.objectid != 0 and drop_level == 0.\\n\\nWhen relocation recovery later processes such a root item,\\nmerge_reloc_root() reads drop_level and hits BUG_ON(level == 0). The\\nsame invalid metadata can also trigger the corresponding BUG_ON() in\\nbtrfs_drop_snapshot().\\n\\n[FIX]\\nFix this by validating the root_item invariant in tree-checker when\\nreading root items from disk: if drop_progress.objectid is non-zero,\\ndrop_level must also be non-zero. Reject such malformed metadata with\\n-EUCLEAN before it reaches merge_reloc_root() or btrfs_drop_snapshot()\\nand triggers the BUG_ON.\\n\\nAfter the fix, the same corruption is correctly rejected by tree-checker\\nand the BUG_ON is no longer triggered.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/295f8075d00442d71dc9ccae421ace1c0d2d9224\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/53ceedd1eb6280ca8359664e0226983eded2ed73\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/850de3d87f4720b71ccdcd44f4aa57e46b53a3f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ac68a9a8e481ab1becaed29d6d23087dac3de15d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b17b79ff896305fd74980a5f72afec370ee88ca4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bedaf7d0b9d793e116f16b4d9a7dbc94bcc80443\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/de585ee18dd5601745f65a60fef7b7ceebd78c83\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.