CVE-2026-46251— btrfs: fix block_group_tree dirty_list corruption
Possible ATT&CK Techniques 1AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 14033b08a02916e85ffc5397e4ac15337359f3ae< 6e10283b5519d987d880d71bec90cdc7f2ec62b3 | affected |
14033b08a02916e85ffc5397e4ac15337359f3ae< e3d1fd084319f8f0830b22f014c7af6a96b4497b | affected | ||
14033b08a02916e85ffc5397e4ac15337359f3ae< 4eb830847d84276f1c8ea46541cfeeedaba1fb63 | affected | ||
14033b08a02916e85ffc5397e4ac15337359f3ae< 80e1fda9c084dcf54819a12bc7682ec0afd2d8f4 | affected | ||
14033b08a02916e85ffc5397e4ac15337359f3ae< 201091da34c4f113af6b4a7407091c39bf29d4ca | affected | ||
14033b08a02916e85ffc5397e4ac15337359f3ae< 3a1f4264daed4b419c325a7fe35e756cada3cf82 | affected | ||
dabf41db56f378a360ff0219c467f8dfecda7dd6 | affected | ||
6.0.19< 6.1 | affected | ||
| … +8 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-46251
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
btrfs: fix block_group_tree dirty_list corruption
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree dirty_list corruption When the incompat flag EXTENT_TREE_V2 is set, we unconditionally add the block group tree to the switch_commits list before calling switch_commit_roots, as we do for the tree root and the chunk root. However, the block group tree uses normal root dirty tracking and in any transaction that does an allocation and dirties a block group, the block group root will already be linked to a list by the dirty_list field and this use of list_add_tail() is invalid and corrupts the prev/next members of block_group_root->dirty_list. This is apparent on a subsequent list_del on the prev if we enable CONFIG_DEBUG_LIST: [32.1571] ------------[ cut here ]------------ [32.1572] list_del corruption. next->prev should beffff958890202538, but was ffff9588992bd538. (next=ffff958890201538) [32.1575] WARNING: lib/list_debug.c:65 at 0x0, CPU#3: sync/607 [32.1583] CPU: 3 UID: 0 PID: 607 Comm: sync Not tainted 6.18.0 #24PREEMPT(none) [32.1585] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS1.17.0-4.fc41 04/01/2014 [32.1587] RIP: 0010:__list_del_entry_valid_or_report+0x108/0x120 [32.1593] RSP: 0018:ffffaa288287fdd0 EFLAGS: 00010202 [32.1594] RAX: 0000000000000001 RBX: ffff95889326e800 RCX:ffff958890201538 [32.1596] RDX: ffff9588992bd538 RSI: ffff958890202538 RDI:ffffffff82a41e00 [32.1597] RBP: ffff958890202538 R08: ffffffff828fc1e8 R09:00000000ffffefff [32.1599] R10: ffffffff8288c200 R11: ffffffff828e4200 R12:ffff958890201538 [32.1601] R13: ffff95889326e958 R14: ffff958895c24000 R15:ffff958890202538 [32.1603] FS: 00007f0c28eb5740(0000) GS:ffff958af2bd2000(0000)knlGS:0000000000000000 [32.1605] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [32.1607] CR2: 00007f0c28e8a3cc CR3: 0000000109942005 CR4:0000000000370ef0 [32.1609] Call Trace: [32.1610] <TASK> [32.1611] switch_commit_roots+0x82/0x1d0 [btrfs] [32.1615] btrfs_commit_transaction+0x968/0x1550 [btrfs] [32.1618] ? btrfs_attach_transaction_barrier+0x23/0x60 [btrfs] [32.1621] __iterate_supers+0xe8/0x190 [32.1622] ? __pfx_sync_fs_one_sb+0x10/0x10 [32.1623] ksys_sync+0x63/0xb0 [32.1624] __do_sys_sync+0xe/0x20 [32.1625] do_syscall_64+0x73/0x450 [32.1626] entry_SYSCALL_64_after_hwframe+0x76/0x7e [32.1627] RIP: 0033:0x7f0c28d05d2b [32.1632] RSP: 002b:00007ffc9d988048 EFLAGS: 00000246 ORIG_RAX:00000000000000a2 [32.1634] RAX: ffffffffffffffda RBX: 00007ffc9d988228 RCX:00007f0c28d05d2b [32.1636] RDX: 00007f0c28e02301 RSI: 00007ffc9d989b21 RDI:00007f0c28dba90d [32.1637] RBP: 0000000000000001 R08: 0000000000000001 R09:0000000000000000 [32.1639] R10: 0000000000000000 R11: 0000000000000246 R12:000055b96572cb80 [32.1641] R13: 000055b96572b19f R14: 00007f0c28dfa434 R15:000055b96572b034 [32.1643] </TASK> [32.1644] irq event stamp: 0 [32.1644] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [32.1646] hardirqs last disabled at (0): [<ffffffff81298817>]copy_process+0xb37/0x2260 [32.1648] softirqs last enabled at (0): [<ffffffff81298817>]copy_process+0xb37/0x2260 [32.1650] softirqs last disabled at (0): [<0000000000000000>] 0x0 [32.1652] ---[ end trace 0000000000000000 ]--- Furthermore, this list corruption eventually (when we happen to add a new block group) results in getting the switch_commits and dirty_cowonly_roots lists mixed up and attempting to call update_root on the tree root which can't be found in the tree root, resulting in a transaction abort: [87.8269] BTRFS critical (device nvme1n1): unable to find root key (1 0 0) in tree 1 [87.8272] ------------[ cut here ]------------ [87.8274] BTRFS: Transaction aborted (error -117) [87.8275] WARNING: fs/btrfs/root-tree.c:153 at 0x0, CPU#4: sync/703 [87.8285] CPU: 4 UID: 0 PID: 703 Comm: sync Not tainted 6.18.0 #25 PREEMPT(none) [87.8287] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-4.fc41 0 ---truncated---
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于btrfs文件系统在设置EXTENT_TREE_V2标志时对block_group_tree的dirty_list使用list_add_tail导致链表损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-46251
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-46251
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-46251 (5)
Same Patch Batch · Linux · 2026-06-03 · 32 CVEs total
| CVE-2026-46244 | 9.1 CRITICAL | netfilter: nft_inner: Fix IPv6 inner_thoff desync |
| CVE-2026-46266 | 9.1 CRITICAL | inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP |
| CVE-2026-46264 | 8.8 HIGH | drm/xe/pf: Fix sysfs initialization |
| CVE-2026-46273 | 8.6 HIGH | ibmveth: Disable GSO for packets with small MSS |
| CVE-2026-46270 | 8.4 HIGH | power: supply: rt9455: Fix use-after-free in power_supply_changed() |
| CVE-2026-46253 | 7.8 HIGH | pstore/ram: fix buffer overflow in persistent_ram_save_old() |
| CVE-2026-46259 | 7.8 HIGH | procfs: fix missing RCU protection when reading real_parent in do_task_stat() |
| CVE-2026-46260 | 7.8 HIGH | ipv6: Fix out-of-bound access in fib6_add_rt2node(). |
| CVE-2026-46263 | 7.8 HIGH | drm/amd/display: Fix out-of-bounds stream encoder index v3 |
| CVE-2026-46271 | 7.8 HIGH | wifi: ath12k: do WoW offloads only on primary link |
| CVE-2026-46265 | 7.5 HIGH | RDMA/hns: Fix WQ_MEM_RECLAIM warning |
| CVE-2026-46250 | 7.3 HIGH | MIPS: Work around LLVM bug when gp is used as global register variable |
| CVE-2026-46245 | drm/amd/display: Fix dc_link NULL handling in HPD init | |
| CVE-2026-46246 | power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler | |
| CVE-2026-46247 | clk: qcom: gfx3d: add parent to parent request map | |
| CVE-2025-71314 | drm/panthor: Recover from panthor_gpu_flush_caches() failures | |
| CVE-2025-71313 | PCI: endpoint: Add missing NULL check for alloc_workqueue() | |
| CVE-2026-46248 | wifi: ath12k: clear stale link mapping of ahvif->links_map | |
| CVE-2026-46249 | octeontx2-af: Fix PF driver crash with kexec kernel booting | |
| CVE-2026-46252 | regulator: core: fix locking in regulator_resolve_supply() error path |
Showing top 20 of 32 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-53277
KVM: arm64: Take the SRCU lock for page table walks in fault - CVE-2026-53276
Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer - CVE-2026-53275
ipv6: mcast: Fix use-after-free when processing MLD queries - CVE-2026-53274
net/smc: fix sleep-inside-lock in __smc_setsockopt() causing - CVE-2026-53273
tee: optee: prevent use-after-free when the client exits bef
Same vendor: Linux
- CVE-2026-53277
KVM: arm64: Take the SRCU lock for page table walks in fault - CVE-2026-53276
Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer - CVE-2026-53275
ipv6: mcast: Fix use-after-free when processing MLD queries - CVE-2026-53274
net/smc: fix sleep-inside-lock in __smc_setsockopt() causing - CVE-2026-53273
tee: optee: prevent use-after-free when the client exits bef
V. Comments for CVE-2026-46251
No comments yet