{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43117", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.987Z", "datePublished": "2026-05-06T07:40:41.862Z", "dateUpdated": "2026-08-05T12:26:03.902Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:26:03.902Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()\n\nIf overlay is used on top of btrfs, dentry->d_sb translates to overlay's\nsuper block and fsid assignment will lead to a crash.\n\nUse file_inode(file)->i_sb to always get btrfs_sb." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable tracepoint is reachable through fsync/flush paths, and a severe reasonable deployment is an NFS/ksmbd-exported overlay filesystem backed by btrfs where a remote client can issue COMMIT/FLUSH into btrfs_sync_file(). Local fsync paths also reach it, but the network file-server path is the highest reasonable vector.\nAC:L - Once the btrfs_sync_file tracepoint/perf event is active, triggering the bug is a deterministic fsync/flush on an overlay-backed btrfs file with no race or timing requirement. Overlay-on-btrfs is a normal supported configuration.\nPR:N - A remote client can plausibly reach the fsync path through a guest or writable NFS/SMB export without privileges on the vulnerable host. When uncertain, the higher severity no-privilege scenario is defensible.\nUI:N - No victim action is needed after the filesystem/export/tracing environment exists; the attacker only sends or performs the fsync/flush operation. Mounting or tracing setup is environmental, not per-exploit user interaction.\nS:U - The impact is within the same kernel security authority and does not cross a hypervisor, IOMMU, or sandbox boundary. Standard kernel crash or kernel-memory exposure remains scope unchanged.\nC:H - The bug type-confuses an overlay superblock as btrfs_fs_info and copies through the bogus fs_devices pointer into trace/perf data. If the pointer resolves to valid kernel memory, this can expose kernel memory, so the higher severity confidentiality impact is selected.\nI:N - The vulnerable operations are invalid reads and writes only to the trace record buffer, not attacker-controlled writes to kernel objects. No direct integrity modification or control-flow overwrite was found.\nA:H - The fix commit explicitly states the bad fsid assignment can crash, and the invalid superblock/fs_devices dereference can oops or panic the kernel. This is high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/trace/events/btrfs.h" ], "versions": [ { "version": "bc074524e123ded281cde25ebc5661910f9679e3", "lessThan": "4a7bab35fad5251c8cb738161152578cd83b6b9c", "status": "affected", "versionType": "git" }, { "version": "bc074524e123ded281cde25ebc5661910f9679e3", "lessThan": "520e8b4bcf872a534a7bf61ccf880047642df296", "status": "affected", "versionType": "git" }, { "version": "bc074524e123ded281cde25ebc5661910f9679e3", "lessThan": "e252db8ca2a01f82d472091f35d549b313278636", "status": "affected", "versionType": "git" }, { "version": "bc074524e123ded281cde25ebc5661910f9679e3", "lessThan": "c09a7446aab5773f38d6abb25fce99b8e1dfbc97", "status": "affected", "versionType": "git" }, { "version": "bc074524e123ded281cde25ebc5661910f9679e3", "lessThan": "32372781d664a9b03c40343e96c29d0a6139f97d", "status": "affected", "versionType": "git" }, { "version": "bc074524e123ded281cde25ebc5661910f9679e3", "lessThan": "2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a", "status": "affected", "versionType": "git" }, { "version": "bc074524e123ded281cde25ebc5661910f9679e3", "lessThan": "d110d7cdb045715c0b45b0dfd974525bb38f653d", "status": "affected", "versionType": "git" }, { "version": "bc074524e123ded281cde25ebc5661910f9679e3", "lessThan": "a85b46db143fda5869e7d8df8f258ccef5fa1719", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/trace/events/btrfs.h" ], "versions": [ { "version": "4.8", "status": "affected" }, { "version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.258" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.209" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1.175" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.6.136" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.12.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.18.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.19.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4a7bab35fad5251c8cb738161152578cd83b6b9c" }, { "url": "https://git.kernel.org/stable/c/520e8b4bcf872a534a7bf61ccf880047642df296" }, { "url": "https://git.kernel.org/stable/c/e252db8ca2a01f82d472091f35d549b313278636" }, { "url": "https://git.kernel.org/stable/c/c09a7446aab5773f38d6abb25fce99b8e1dfbc97" }, { "url": "https://git.kernel.org/stable/c/32372781d664a9b03c40343e96c29d0a6139f97d" }, { "url": "https://git.kernel.org/stable/c/2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a" }, { "url": "https://git.kernel.org/stable/c/d110d7cdb045715c0b45b0dfd974525bb38f653d" }, { "url": "https://git.kernel.org/stable/c/a85b46db143fda5869e7d8df8f258ccef5fa1719" } ], "title": "btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()", "x_generator": { "engine": "bippy-1.2.0" } } } }