CVE-2026-43299: Linux Kernel Privilege Escalation Bug

CVE-2026-43299 Overview

CVE-2026-43299 is a Linux kernel vulnerability in the btrfs filesystem. The flaw resides in the btrfs_repair_io_failure() function within fs/btrfs/bio.c. When btrfs encounters an ENOSPC error in a critical path, the filesystem flips to read-only mode. If a read-repair operation is pending during this transition, the kernel triggers an ASSERT() because the code expects the superblock to not be marked read-only. The resulting assertion failure produces a kernel BUG and crash. The fix replaces the assertion with a graceful return when the filesystem is already read-only.

Critical Impact
Local attackers or unprivileged workloads that trigger btrfs I/O failure paths during a read-only transition can cause a kernel panic, resulting in denial of service.

Affected Products

Linux Kernel (btrfs filesystem)
Distributions shipping vulnerable kernel versions prior to the upstream fix
Systems using btrfs as the root or data filesystem

Discovery Timeline

2026-05-08 - CVE-2026-43299 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43299

Vulnerability Analysis

The vulnerability is a Kernel Vulnerability classified under [NVD-CWE-noinfo], manifesting as an assertion-induced denial of service. The btrfs read-repair logic in btrfs_repair_io_failure() invokes ASSERT(!(fs_info->sb->s_flags & SB_RDONLY)) at fs/btrfs/bio.c:938. This assertion enforces the invariant that the filesystem is mounted read-write before attempting repair writes. The invariant breaks when a concurrent critical error, such as an ENOSPC during transaction commit, aborts the transaction and flips the superblock to read-only. Any in-flight read-repair worker then triggers the assertion and produces a kernel BUG at fs/btrfs/bio.c:938. The crash occurs in the btrfs-endio workqueue context, taking down the kernel with an invalid opcode oops.

Root Cause

The root cause is a race between the transaction abort path that sets SB_RDONLY and the asynchronous read-repair worker that checks this flag via an assertion rather than a runtime conditional. The assertion was written under the assumption that the filesystem state cannot change between the start of the repair operation and its execution. In practice, transaction aborts on ENOSPC invalidate this assumption, leaving the repair worker to crash the kernel.

Attack Vector

Exploitation requires local access and the ability to induce btrfs into the conditions that trigger transaction abort, such as filling metadata reservations to provoke ENOSPC during balance or relocation operations. A workload that simultaneously generates read errors requiring repair, for example on a raid1 metadata block group with a corrupted mirror, can race the read-repair path against the read-only flip. The vulnerability does not yield code execution or data disclosure; impact is restricted to availability through kernel panic.

No verified exploit code is publicly available. The vulnerability mechanism is documented in the upstream commit messages referenced under vendor advisories.

Detection Methods for CVE-2026-43299

Indicators of Compromise

Kernel log entries containing assertion failed: !(fs_info->sb->s_flags & SB_RDONLY) referencing fs/btrfs/bio.c:938.
kernel BUG at fs/btrfs/bio.c panic traces with btrfs_repair_io_failure in the call stack.
Preceding BTRFS: Transaction aborted (error -28) messages indicating an ENOSPC abort and read-only flip.

Detection Strategies

Monitor dmesg and journalctl -k for btrfs transaction abort messages followed by parent transid verify failed or bdev errs: ... corrupt entries.
Correlate unexpected node reboots with btrfs kernel oops traces using centralized log aggregation.
Track the installed kernel package version against distribution security advisories for the upstream fix commits 8ceaad6 and f6df18c.

Monitoring Recommendations

Forward kernel ring buffer messages to a SIEM and alert on btrfs assertion failures or read-only transitions.
Track btrfs filesystem free space and metadata allocation to identify systems trending toward ENOSPC.
Enable kernel crash dump collection with kdump to capture forensic data when assertions trigger.

How to Mitigate CVE-2026-43299

Immediate Actions Required

Apply the upstream Linux kernel patches 8ceaad6cd6e7fa5f73b0b2796a2e85d75d37e9f3 and f6df18c001e3dcebc08482d0adeacd0cfea08593 or update to a distribution kernel containing the fix.
Reboot affected systems after patching to ensure the corrected btrfs module is loaded.
Maintain adequate free space on btrfs volumes to reduce the probability of triggering ENOSPC aborts.

Patch Information

The fix replaces the ASSERT() in btrfs_repair_io_failure() with a normal return when fs_info->sb->s_flags & SB_RDONLY is set. Patch details are available in the Kernel Git Commit 8ceaad6 and Kernel Git Commit f6df18c.

Workarounds

Monitor btrfs metadata usage with btrfs filesystem usage and proactively rebalance or expand volumes before metadata exhaustion.
Avoid running large balance or relocation operations on production systems with tight free space until the kernel is patched.
Where feasible, restrict local untrusted users on systems backed by btrfs to limit the ability to induce I/O failure conditions.

bash

# Verify the running kernel and check for the btrfs fix
uname -r
grep -r "btrfs_repair_io_failure" /usr/src/linux-$(uname -r)/fs/btrfs/bio.c

# Inspect btrfs filesystem health and free space
btrfs filesystem usage /
btrfs device stats /

# Watch for assertion failures and read-only flips
dmesg -T | grep -E "btrfs|assertion failed|SB_RDONLY"