CVE-2026-23043: Linux Kernel NULL Pointer Vulnerability

CVE-2026-23043 Overview

CVE-2026-23043 is a NULL pointer dereference vulnerability in the Linux kernel's btrfs filesystem implementation. The flaw exists in the do_abort_log_replay() function and was identified by Coverity static analysis (CID 1666756). When btrfs_alloc_path() fails inside replay_one_buffer(), the wc->subvol_path pointer remains NULL. The abort handler btrfs_abort_log_replay() then calls do_abort_log_replay(), which unconditionally dereferences wc->subvol_path while printing debug information, triggering a kernel crash [CWE-476].

Critical Impact
A NULL pointer dereference during btrfs log replay can cause a kernel panic, leading to denial of service on systems mounting affected btrfs volumes.

Affected Products

Linux kernel (btrfs subsystem) — versions containing the vulnerable do_abort_log_replay() code path
Distributions shipping affected upstream kernel builds prior to the fix commits
Stable kernel trees referenced by commits 530e3d4af566 and 6d1b61b8e1e4

Discovery Timeline

2026-02-04 - CVE-2026-23043 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-23043

Vulnerability Analysis

The vulnerability resides in the btrfs log replay error handling path. During tree-log replay, btrfs allocates a path structure via btrfs_alloc_path() inside replay_one_buffer(). If this allocation fails, the walker control structure field wc->subvol_path is never initialized and stays NULL.

The error path subsequently invokes btrfs_abort_log_replay(), which calls do_abort_log_replay() to record diagnostic state. That function dereferences wc->subvol_path without a NULL check while formatting debug output. The result is a kernel-mode NULL pointer dereference that triggers an oops or panic depending on kernel configuration.

Root Cause

The root cause is missing input validation in the abort/diagnostic path. The fix adds a NULL check before dereferencing wc->subvol_path in do_abort_log_replay(), ensuring debug printing is safely skipped when the path was never allocated. The defect is a classic [CWE-476] NULL Pointer Dereference introduced by an implicit assumption that an earlier allocation always succeeds.

Attack Vector

Exploitation requires conditions that cause btrfs_alloc_path() to fail during log replay, such as memory pressure or a crafted/corrupted btrfs image mounted by a user with mount privileges. A local actor able to mount a malicious btrfs image, or trigger allocation failure during replay of a dirty log, can induce a kernel crash. The vulnerability is a denial-of-service condition with no indicators of code execution or privilege escalation.

No public proof-of-concept code is available. Technical details are documented in the upstream kernel commits 530e3d4af566 and 6d1b61b8e1e4.

Detection Methods for CVE-2026-23043

Indicators of Compromise

Kernel oops or panic messages referencing do_abort_log_replay, btrfs_abort_log_replay, or replay_one_buffer in dmesg and /var/log/kern.log.
Repeated mount failures of btrfs volumes accompanied by NULL pointer dereference stack traces.
Unexpected system reboots correlated with btrfs mount operations on volumes containing a dirty log tree.

Detection Strategies

Audit installed kernel versions against the fix commits 530e3d4af566 and 6d1b61b8e1e4 using package inventory tooling.
Parse kernel ring buffer logs for BUG: kernel NULL pointer dereference entries with btrfs symbols in the call trace.
Monitor for repeated mount syscall failures returning -ENOMEM near btrfs log replay operations.

Monitoring Recommendations

Centralize kernel logs from all Linux hosts and alert on btrfs-related oops signatures.
Track btrfs filesystem mount operations on multi-tenant systems where untrusted users may supply images.
Establish a baseline of kernel versions across the fleet and flag any host running an unpatched build.

How to Mitigate CVE-2026-23043

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 530e3d4af566ca44807d79359b90794dea24c4f3 and 6d1b61b8e1e44888c643d89225ab819b10649b2e.
Update to a distribution kernel that incorporates the btrfs do_abort_log_replay() NULL check fix.
Restrict the ability of unprivileged users to mount arbitrary btrfs images on production systems.

Patch Information

The fix adds a NULL check for wc->subvol_path before dereferencing it in do_abort_log_replay(). Patches are available in the stable kernel tree via Kernel Git Commit 530e3d4af566 and Kernel Git Commit 6d1b61b8e1e4. Rebuild and reboot into the patched kernel to fully remediate.

Workarounds

Avoid mounting untrusted or potentially corrupted btrfs images on unpatched kernels.
Disable automatic mounting of removable btrfs media via udev rules where feasible.
Ensure adequate memory headroom to reduce the likelihood of btrfs_alloc_path() allocation failures triggering the bug.

bash

# Verify the running kernel and check for the patched commits
uname -r

# On distributions using DKMS / source, confirm patch presence
grep -n "subvol_path" fs/btrfs/tree-log.c | head

# Restrict user mount capability via systemd or udev policy
# Example: prevent non-root users from mounting btrfs images
echo 'kernel.unprivileged_userns_clone = 0' >> /etc/sysctl.d/99-btrfs-hardening.conf
sysctl --system