Към съдържанието
Търсене

CVE-2026-43046: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: btrfs: reject root items with drop_progress and zero drop_level [BUG] When recovering relocation at mount time, merge_reloc_root() and btrfs_drop_snapshot() both use BUG_ON(level == 0) to guard against an impossible state: a non-zero drop_progress combined with a zero drop_level in a root_item, which can be triggered: ------------[ cut here ]------------ kernel BUG at fs/btrfs/relocation.c:1545! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 283 ... Tainted: 6.18.0+ #16 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Ubuntu 24.04 PC v2, BIOS 1.16.3-debian-1.16.3-2 RIP: 0010:merge_reloc_root+0x1266/0x1650 fs/btrfs/relocation.c:1545 Code: ffff0000 00004589 d7e9acfa ffffe8a1 79bafebe 02000000 Call Trace: merge_reloc_roots+0x295/0x890 fs/btrfs/relocation.c:1861 btrfs_recover_relocation+0xd6e/0x11d0 fs/btrfs/relocation.c:4195 btrfs_start_pre_rw_mount+0xa4d/0x1810 fs/btrfs/disk-io.c:3130 open_ctree+0x5824/0x5fe0 fs/btrfs/disk-io.c:3640 btrfs_fill_super fs/btrfs/super.c:987 [inline] btrfs_get_tree_super fs/btrfs/super.c:1951 [inline] btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline] btrfs_get_tree+0x111c/0x2190 fs/btrfs/super.c:2128 vfs_get_tree+0x9a/0x370 fs/super.c:1758 fc_mount fs/namespace.c:1199 [inline] do_new_mount_fc fs/namespace.c:3642 [inline] do_new_mount fs/namespace.c:3718 [inline] path_mount+0x5b8/0x1ea0 fs/namespace.c:4028 do_mount fs/namespace.c:4041 [inline] __do_sys_mount fs/namespace.c:4229 [inline] __se_sys_mount fs/namespace.c:4206 [inline] __x64_sys_mount+0x282/0x320 fs/namespace.c:4206 ... RIP: 0033:0x7f969c9a8fde Code: 0f1f4000 48c7c2b0 fffffff7 d8648902 b8ffffff ffc3660f ---[ end trace 0000000000000000 ]--- The bug is reproducible on 7.0.0-rc2-next-20260310 with our dynamic metadata fuzzing tool that corrupts btrfs metadata at runtime. [CAUSE] A non-zero drop_progress.objectid means an interrupted btr

    Засегнати продукти

    • Linux Linux: 9f3a742736cecda5a8778be70faa2f779458839f преди bedaf7d0b9d793e116f16b4d9a7dbc94bcc80443; 9f3a742736cecda5a8778be70faa2f779458839f преди ac68a9a8e481ab1becaed29d6d23087dac3de15d; 9f3a742736cecda5a8778be70faa2f779458839f преди 295f8075d00442d71dc9ccae421ace1c0d2d9224; 9f3a742736cecda5a8778be70faa2f779458839f преди 53ceedd1eb6280ca8359664e0226983eded2ed73; 9f3a742736cecda5a8778be70faa2f779458839f преди 850de3d87f4720b71ccdcd44f4aa57e46b53a3f3; 9f3a742736cecda5a8778be70faa2f779458839f преди de585ee18dd5601745f65a60fef7b7ceebd78c83; 9f3a742736cecda5a8778be70faa2f779458839f преди b17b79ff896305fd74980a5f72afec370ee88ca4
    • Linux Linux: 2.6.29; преди 2.6.29; 5.15.203 до 5.15.*; 6.1.168 до 6.1.*; 6.6.134 до 6.6.*; 6.12.81 до 6.12.*; 6.18.22 до 6.18.*; 6.19.12 до 6.19.*; 7.0 до *

    История

    • 1 май 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-43046: Linux | freedomonline.bg