CVE-2026-43117: Linux Kernel Btrfs DoS Vulnerability

CVE-2026-43117 Overview

CVE-2026-43117 is a Linux kernel vulnerability in the btrfs filesystem tracepoint subsystem. The flaw resides in the btrfs_sync_file() tracepoint handler, which incorrectly resolves the superblock from a dentry structure. When overlayfs is layered on top of btrfs, dentry->d_sb points to the overlay superblock rather than the underlying btrfs superblock. Subsequent fsid assignment treats the overlay superblock as a btrfs_sb, causing a kernel crash. The fix replaces dentry->d_sb with file_inode(file)->i_sb to consistently retrieve the btrfs superblock.

Critical Impact
Local users on systems running overlayfs over btrfs with btrfs tracepoints enabled can trigger a kernel crash, resulting in denial of service.

Affected Products

Linux kernel with btrfs filesystem support
Systems using overlayfs mounted on top of btrfs
Linux distributions shipping affected kernel versions prior to the upstream fix

Discovery Timeline

2026-05-06 - CVE-2026-43117 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43117

Vulnerability Analysis

The vulnerability exists in the btrfs tracepoint code path triggered during file synchronization. The trace_btrfs_sync_file() event handler retrieves the superblock from a dentry passed into the tracepoint. The handler then casts that superblock to a btrfs_fs_info-related structure to read the filesystem identifier (fsid).

When overlayfs stacks on top of btrfs, the dentry belongs to the overlay mount. Its d_sb field references the overlay superblock, not the underlying btrfs superblock. The tracepoint code dereferences fields expected to exist on a btrfs superblock, leading to invalid memory access and a kernel oops. This is a kernel-level denial of service caused by an incorrect type assumption.

The defect is classified as a kernel vulnerability with characteristics of type confusion between superblock structures of different filesystems.

Root Cause

The root cause is the use of dentry->d_sb to obtain the btrfs superblock inside trace_btrfs_sync_file(). With stacked filesystems, d_sb reflects the topmost mount, not the underlying filesystem that owns the inode data. The tracepoint assumes a one-to-one mapping between dentry and filesystem superblock, which does not hold under overlayfs.

Attack Vector

A local user with write access to an overlayfs mount backed by btrfs can trigger the crash by performing operations that fire the btrfs_sync_file tracepoint, such as fsync() on a file, while btrfs tracing is active. Exploitation requires local access and an environment where overlay-on-btrfs is configured, which is common in container runtimes that use overlayfs over btrfs-backed storage.

The vulnerability is described in the upstream patch series. See the Linux Kernel Commit a85b46db for the technical fix that switches the superblock lookup to file_inode(file)->i_sb.

Detection Methods for CVE-2026-43117

Indicators of Compromise

Unexpected kernel oops or panic messages referencing btrfs_sync_file or trace_btrfs_sync_file in dmesg or /var/log/kern.log
Crash stack traces involving overlayfs and btrfs tracepoint code paths
System reboots correlated with workloads using fsync() on overlay-on-btrfs mounts while ftrace events are enabled

Detection Strategies

Inventory hosts running kernels prior to the patched stable releases referenced in the upstream commits and identify systems where overlayfs is mounted over btrfs
Audit container runtime storage drivers (Docker, containerd, Podman) for overlay2 configurations backed by btrfs
Monitor for tracepoint or ftrace activation events on production hosts using overlay-on-btrfs

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on btrfs and overlayfs oops signatures
Track kernel package versions across the fleet to confirm patch deployment status
Monitor unexpected node reboots in container orchestration platforms running btrfs-backed storage

How to Mitigate CVE-2026-43117

Immediate Actions Required

Apply the upstream Linux kernel patch that replaces dentry->d_sb with file_inode(file)->i_sb in the btrfs_sync_file tracepoint
Update to a stable kernel release that incorporates the fix from the referenced upstream commits
Where patching is delayed, disable btrfs tracepoints on systems running overlayfs over btrfs

Patch Information

The fix is available in the upstream Linux kernel via multiple stable branch backports. Reference commits include Linux Kernel Commit 2e4adfa, Linux Kernel Commit 32372781, Linux Kernel Commit a85b46db, Linux Kernel Commit c09a7446, and Linux Kernel Commit d110d7cd. Apply vendor-supplied kernel updates from your Linux distribution as they become available.

Workarounds

Disable btrfs ftrace events on affected hosts by ensuring /sys/kernel/debug/tracing/events/btrfs/btrfs_sync_file/enable remains set to 0
Avoid stacking overlayfs on top of btrfs where feasible; use an alternative storage driver or backing filesystem for container runtimes
Restrict local user access on systems where the patch cannot be applied immediately

bash

# Verify btrfs sync_file tracepoint is disabled
cat /sys/kernel/debug/tracing/events/btrfs/btrfs_sync_file/enable

# Disable the tracepoint if currently enabled
echo 0 > /sys/kernel/debug/tracing/events/btrfs/btrfs_sync_file/enable

# Check kernel version against patched stable releases
uname -r