CVE-2026-43046: Linux Kernel Privilege Escalation Flaw

CVE-2026-43046 Overview

CVE-2026-43046 is a Linux kernel vulnerability in the btrfs filesystem. The flaw stems from missing validation of root item invariants when reading metadata from disk. A corrupted root item containing a non-zero drop_progress.objectid paired with a zero drop_level bypasses kernel checks and reaches merge_reloc_root() and btrfs_drop_snapshot(). Both functions assert this state is impossible and call BUG_ON(level == 0), halting the kernel. The issue triggers during mount-time relocation recovery in fs/btrfs/relocation.c:1545. Researchers reproduced it on kernel 7.0.0-rc2-next-20260310 using a dynamic metadata fuzzing tool. The fix adds tree-checker validation that rejects malformed root items with -EUCLEAN before they reach the buggy code paths.

Critical Impact
A crafted or corrupted btrfs filesystem image triggers a kernel BUG_ON during mount, resulting in a denial-of-service condition through kernel panic.

Affected Products

Linux kernel btrfs filesystem subsystem
Linux kernel 7.0.0-rc2-next-20260310 (confirmed reproduction target)
Stable kernel branches receiving the referenced backport commits

Discovery Timeline

2026-05-01 - CVE-2026-43046 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-43046

Vulnerability Analysis

The vulnerability resides in btrfs relocation recovery logic. When btrfs_drop_snapshot() is interrupted, the kernel saves a checkpoint into the root item containing drop_progress and drop_level fields. The kernel only writes this checkpoint at internal node levels, so drop_level must be greater than zero whenever drop_progress.objectid is non-zero.

The write path enforces this invariant. The read path does not. When the on-disk root item is corrupted or maliciously crafted, the kernel loads the inconsistent state without validation. During mount-time relocation recovery, merge_reloc_root() reads drop_level, encounters zero, and triggers BUG_ON(level == 0) at fs/btrfs/relocation.c:1545. The same condition triggers a parallel BUG_ON inside btrfs_drop_snapshot().

Root Cause

The tree-checker subsystem validates btrfs metadata on read but did not check root item field consistency. Specifically, no rule asserted that a non-zero drop_progress.objectid requires a non-zero drop_level. This omission allowed corrupted metadata to propagate through the stack until it hit a defensive BUG_ON that assumed the invariant always held.

Attack Vector

An attacker who can supply a crafted btrfs filesystem image, for example through a removable device, loop-mounted file, or storage attached to a multi-tenant system, can mount the filesystem and trigger the kernel bug. The crash occurs inside the mount path through the call chain btrfs_get_tree → open_ctree → btrfs_start_pre_rw_mount → btrfs_recover_relocation → merge_reloc_roots → merge_reloc_root. Local privileges sufficient to mount filesystems are required. Successful exploitation produces a kernel panic and denial of service.

No verified public exploit code is available. The fix adds a tree-checker rule that rejects root items where drop_progress.objectid != 0 and drop_level == 0, returning -EUCLEAN before the corrupted state reaches relocation code.

Detection Methods for CVE-2026-43046

Indicators of Compromise

Kernel panic messages referencing kernel BUG at fs/btrfs/relocation.c:1545 in system logs.
Mount failures on btrfs volumes accompanied by merge_reloc_root stack traces.
Unexpected -EUCLEAN errors on patched kernels indicating rejected malformed root items.

Detection Strategies

Monitor dmesg and journalctl output for BUG_ON traces originating from fs/btrfs/relocation.c or btrfs_drop_snapshot.
Audit mount events of btrfs filesystems from removable media, loop devices, and untrusted sources.
Correlate kernel oops events with preceding mount system calls to identify malicious image attempts.

Monitoring Recommendations

Enable persistent kernel crash dump collection through kdump to preserve evidence after panic.
Forward kernel logs to a centralized logging platform for cross-host correlation of btrfs failures.
Track filesystem mount activity originating from non-administrative users and removable storage.

How to Mitigate CVE-2026-43046

Immediate Actions Required

Apply the upstream btrfs tree-checker patches referenced in the kernel.org commits below.
Restrict mounting of btrfs filesystems from untrusted sources, including USB media and user-supplied images.
Disable automatic filesystem mounting on multi-user and kiosk systems until patched kernels are deployed.

Patch Information

The fix adds a tree-checker validation rule that rejects malformed root items with -EUCLEAN before they reach merge_reloc_root() or btrfs_drop_snapshot(). The patch is distributed across the following stable branches:

Workarounds

Block the btrfs kernel module on systems that do not require it using blacklist btrfs in /etc/modprobe.d/.
Restrict the mount capability to administrative users by tightening polkit and udev rules for removable media.
Validate btrfs images with btrfs check on a sandboxed host before mounting on production systems.

bash

# Configuration example: prevent unprivileged btrfs mounts via udev
echo 'blacklist btrfs' | sudo tee /etc/modprobe.d/disable-btrfs.conf
sudo update-initramfs -u

# Verify patched kernel rejects malformed root items
dmesg | grep -i 'tree-checker' | grep -i 'EUCLEAN'