CVE-2026-23214: Linux Kernel Btrfs DoS Vulnerability

CVE-2026-23214 Overview

A vulnerability has been identified in the Linux kernel's Btrfs filesystem implementation where new transactions are incorrectly allowed on filesystems mounted with rescue mount options. When a heavily corrupted filesystem is mounted with all rescue mount options (marking the filesystem as fully read-only), the system incorrectly permits new transactions during unmount operations, specifically during inode eviction. This leads to transaction aborts and kernel warnings that can destabilize system behavior.

Critical Impact
Linux systems using Btrfs filesystems with rescue mount options may experience kernel warnings, transaction aborts, and potential system instability during unmount operations on corrupted filesystems.

Affected Products

Linux kernel versions with Btrfs filesystem support
Systems using Btrfs rescue mount options
Linux kernel versions prior to the security patches

Discovery Timeline

2026-02-18 - CVE CVE-2026-23214 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23214

Vulnerability Analysis

This vulnerability exists in the Linux kernel's Btrfs filesystem transaction handling mechanism. The core issue arises from an inconsistency in how the filesystem handles read-only states when rescue mount options are applied.

Btrfs is designed to allow new transactions even on read-only filesystems to support log replay functionality during read-only mounts, similar to ext4 and XFS behavior. However, when rescue mount options are used, the filesystem enters a fully read-only state that cannot be remounted read-write. The current implementation fails to account for this special case.

During the unmount process, the kernel evicts all inodes, which triggers transaction creation attempts. When a heavily fuzzed or corrupted filesystem is mounted with rescue options, these transaction attempts result in aborted transactions with error code -22 (EINVAL) and generate kernel warnings through the call stack involving btrfs_evict_inode, btrfs_truncate_inode_items, and find_free_extent.

Root Cause

The root cause lies in the transaction initiation logic within the Btrfs subsystem. The code path through btrfs_reserve_extent() → btrfs_alloc_tree_block() → btrfs_force_cow_block() → btrfs_cow_block() → btrfs_search_slot() → btrfs_truncate_inode_items() does not properly check whether the filesystem has been mounted with rescue options before allowing new transactions. Since rescue mount options indicate a filesystem state that should not permit any write operations or new transactions, this oversight allows invalid operations to proceed, resulting in the observed transaction aborts and kernel warnings.

Attack Vector

The attack vector requires local access to a system with a corrupted or maliciously crafted Btrfs filesystem image. An attacker could craft a heavily fuzzed filesystem image that, when mounted with rescue mount options and subsequently unmounted, triggers the vulnerable code path. While this vulnerability primarily manifests as a denial of service through kernel warnings and potential system instability, it could be leveraged in scenarios where:

A malicious filesystem image is distributed and mounted by system administrators
Automated backup or recovery systems process untrusted filesystem images
Forensic analysis systems mount potentially corrupted evidence images

The exploitation occurs automatically during the unmount sequence when inodes are evicted, requiring no additional user interaction after the initial mount operation.

Detection Methods for CVE-2026-23214

Indicators of Compromise

Kernel log messages containing "BTRFS: Transaction aborted (error -22)" during unmount operations
Stack traces referencing find_free_extent_update_loop or btrfs_evict_inode in kernel logs
Systems experiencing unexpected behavior when unmounting Btrfs filesystems mounted with rescue options

Detection Strategies

Monitor kernel logs (dmesg, /var/log/kern.log) for Btrfs transaction abort messages with error code -22
Implement log correlation rules to detect patterns of Btrfs warnings during filesystem unmount operations
Use kernel tracing tools to monitor calls to btrfs_start_transaction() when rescue mount flags are active

Monitoring Recommendations

Configure centralized logging to capture and alert on Btrfs transaction abort events
Implement filesystem mount option auditing to track usage of rescue mount parameters
Deploy kernel integrity monitoring to detect unexpected behavior in Btrfs subsystem operations

How to Mitigate CVE-2026-23214

Immediate Actions Required

Apply the latest kernel patches that address this vulnerability
Avoid mounting untrusted or potentially corrupted Btrfs filesystems with rescue mount options on production systems
Isolate filesystem recovery operations to dedicated, non-production environments

Patch Information

Security patches have been released to address this vulnerability. The fix ensures that when rescue mount options are detected, the filesystem is treated as being in an error state, preventing new transactions from being started. The following kernel commits contain the fix:

Update to the latest stable kernel version that includes these patches.

Workarounds

Use alternative filesystems (ext4, XFS) for recovery operations on untrusted filesystem images when possible
Perform Btrfs recovery operations in isolated virtual machines or containers to limit impact
Ensure proper system monitoring is in place to detect and respond to kernel warnings during filesystem operations

bash

# Check current kernel version
uname -r

# Verify Btrfs module version
modinfo btrfs | grep version

# Review mounted Btrfs filesystems for rescue options
mount | grep btrfs