Към съдържанието
Търсене

CVE-2026-43338: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: btrfs: reserve enough transaction items for qgroup ioctls Currently our qgroup ioctls don't reserve any space, they just do a transaction join, which does not reserve any space, neither for the quota tree updates nor for the delayed refs generated when updating the quota tree. The quota root uses the global block reserve, which is fine most of the time since we don't expect a lot of updates to the quota root, or to be too close to -ENOSPC such that other critical metadata updates need to resort to the global reserve. However this is not optimal, as not reserving proper space may result in a transaction abort due to not reserving space for delayed refs and then abusing the use of the global block reserve. For example, the following reproducer (which is unlikely to model any real world use case, but just to illustrate the problem), triggers such a transaction abort due to -ENOSPC when running delayed refs: $ cat test.sh #!/bin/bash DEV=/dev/nullb0 MNT=/mnt/nullb0 umount $DEV &> /dev/null # Limit device to 1G so that it's much faster to reproduce the issue. mkfs.btrfs -f -b 1G $DEV mount -o commit=600 $DEV $MNT fallocate -l 800M $MNT/filler btrfs quota enable $MNT for ((i = 1; i <= 400000; i++)); do btrfs qgroup create 1/$i $MNT done umount $MNT When running this, we can see in dmesg/syslog that a transaction abort happened: [436.490] BTRFS error (device nullb0): failed to run delayed ref for logical 30408704 num_bytes 16384 type 176 action 1 ref_mod 1: -28 [436.493] ------------[ cut here ]------------ [436.494] BTRFS: Transaction aborted (error -28) [436.495] WARNING: fs/btrfs/extent-tree.c:2247 at btrfs_run_delayed_refs+0xd9/0x110 [btrfs], CPU#4: umount/2495372 [436.497] Modules linked in: btrfs loop (...) [436.508] CPU: 4 UID: 0 PID: 2495372 Comm: umount Tainted: G W 6.19.0-rc8-btrfs-next-225+ #1 PREEMPT(full) [436.510] Tain

    Засегнати продукти

    • Linux Linux: 5d13a37bd5327220e13329943d1228acfbe5934a преди 4ccd563214419cef14a54df9333ed655484e9dc8; 5d13a37bd5327220e13329943d1228acfbe5934a преди 320942ce316a17b104b5814db55e42a42c2442cf; 5d13a37bd5327220e13329943d1228acfbe5934a преди bb6eb33c908edbbb4d92abdc0c6c87f21b4952e8; 5d13a37bd5327220e13329943d1228acfbe5934a преди cf930a651eef6f8d915bf0ccd60c2045974f870c; 5d13a37bd5327220e13329943d1228acfbe5934a преди 386f5e16a383101a68e195c806b4eedb233cd1d3; 5d13a37bd5327220e13329943d1228acfbe5934a преди f9a4e3015db1aeafbef407650eb8555445ca943e
    • Linux Linux: 3.6; преди 3.6; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.81 до 6.12.*; 6.18.22 до 6.18.*; 6.19.12 до 6.19.*; 7.0 до *

    История

    • 8 май 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-43338: Linux | freedomonline.bg