Към съдържанието
Търсене

CVE-2026-31519: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create We have recently observed a number of subvolumes with broken dentries. ls-ing the parent dir looks like: drwxrwxrwt 1 root root 16 Jan 23 16:49 . drwxr-xr-x 1 root root 24 Jan 23 16:48 .. d????????? ? ? ? ? ? broken_subvol and similarly stat-ing the file fails. In this state, deleting the subvol fails with ENOENT, but attempting to create a new file or subvol over it errors out with EEXIST and even aborts the fs. Which leaves us a bit stuck. dmesg contains a single notable error message reading: "could not do orphan cleanup -2" 2 is ENOENT and the error comes from the failure handling path of btrfs_orphan_cleanup(), with the stack leading back up to btrfs_lookup(). btrfs_lookup btrfs_lookup_dentry btrfs_orphan_cleanup // prints that message and returns -ENOENT After some detailed inspection of the internal state, it became clear that: - there are no orphan items for the subvol - the subvol is otherwise healthy looking, it is not half-deleted or anything, there is no drop progress, etc. - the subvol was created a while ago and does the meaningful first btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much later. - after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT, which results in a negative dentry for the subvolume via d_splice_alias(NULL, dentry), leading to the observed behavior. The bug can be mitigated by dropping the dentry cache, at which point we can successfully delete the subvolume if we want. i.e., btrfs_lookup() btrfs_lookup_dentry() if (!sb_rdonly(inode->vfs_inode)->vfs_inode) btrfs_orphan_cleanup(sub_root) test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) btrfs_search_slot() // finds orphan item for inode N ... prints "could not do orphan cleanup -2" if (inode == ERR_PTR(-ENOENT)) inode = NULL; return d_splice_alia

    Засегнати продукти

    • Linux Linux: c71bf099abddf3e0fdc27f251ba76fca1461d49a преди d43da8de0ed376abafbad8a245a1835e8f66cb0f; c71bf099abddf3e0fdc27f251ba76fca1461d49a преди c57276ced3c3207f42182dfa2f0d8e860357e111; c71bf099abddf3e0fdc27f251ba76fca1461d49a преди a41a9b8d19a98b45591528c6e54d31cc66271d1e; c71bf099abddf3e0fdc27f251ba76fca1461d49a преди 2ec578e6452138ab76f6c9a9c18711fcd197649f; c71bf099abddf3e0fdc27f251ba76fca1461d49a преди 696683f214495db3cdacab9a713efaaced8660f8; c71bf099abddf3e0fdc27f251ba76fca1461d49a преди 5131fa077f9bb386a1b901bf5b247041f0ec8f80; c4ba0bd9db5e8fd2664be0fd4ec01335fe3268eb; 2.6.32.19 преди 2.6.33
    • Linux Linux: 2.6.33; преди 2.6.33; 6.1.168 до 6.1.*; 6.6.131 до 6.6.*; 6.12.80 до 6.12.*; 6.18.21 до 6.18.*; 6.19.11 до 6.19.*; от 7.0 нататък

    История

    • 22 април 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-31519: Linux | freedomonline.bg