Към съдържанието
Търсене

CVE-2026-43361: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort when snapshotting received subvolumes Currently a user can trigger a transaction abort by snapshotting a previously received snapshot a bunch of times until we reach a BTRFS_UUID_KEY_RECEIVED_SUBVOL item overflow (the maximum item size we can store in a leaf). This is very likely not common in practice, but if it happens, it turns the filesystem into RO mode. The snapshot, send and set_received_subvol and subvol_setflags (used by receive) don't require CAP_SYS_ADMIN, just inode_owner_or_capable(). A malicious user could use this to turn a filesystem into RO mode and disrupt a system. Reproducer script: $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi # Use smallest node size to make the test faster. mkfs.btrfs -f --nodesize 4K $DEV mount $DEV $MNT # Create a subvolume and set it to RO so that it can be used for send. btrfs subvolume create $MNT/sv touch $MNT/sv/foo btrfs property set $MNT/sv ro true # Send and receive the subvolume into snaps/sv. mkdir $MNT/snaps btrfs send $MNT/sv | btrfs receive $MNT/snaps # Now snapshot the received subvolume, which has a received_uuid, a # lot of times to trigger the leaf overflow. total=500 for ((i = 1; i <= $total; i++)); do echo -ne "\rCreating snapshot $i/$total" btrfs subvolume snapshot -r $MNT/snaps/sv $MNT/snaps/sv_$i > /dev/null done echo umount $MNT When running the test: $ ./test.sh (...) Create subvolume '/mnt/sdi/sv' At subvol /mnt/sdi/sv At subvol sv Creating snapshot 496/500ERROR: Could not create subvolume: Value too large for defined data type Creating snapshot 497/500ERROR: Could not create subvolume: Read-only file system Creating snapshot 498/500ERROR: Could not create subvolume: Read-only file system Creating snapshot 499/500ERROR: Could not create subvolume: Read-only file system Creating snapshot 500/500ERROR: Could not crea

    Засегнати продукти

    • Linux Linux: dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70 преди 9a9227b488ffb7cdbb5d930a01fc6956c05ba61a; dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70 преди 6bce705b699cba9afccb996c77d194fe003dfa2a; dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70 преди e3d8efc157bc590457d3e31da403af1a221643d6; dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70 преди bac55dde8efa457e769c934fd88a63f2141ba238; dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70 преди 770af8e465c2c3de528f85e840eab462dd41542b; dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70 преди e1b18b959025e6b5dbad668f391f65d34b39595a
    • Linux Linux: 3.12; преди 3.12; 6.1.167 до 6.1.*; 6.6.130 до 6.6.*; 6.12.78 до 6.12.*; 6.18.19 до 6.18.*; 6.19.9 до 6.19.*; 7.0 до *

    История

    • 8 май 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-43361: Linux | freedomonline.bg