CVE-2026-43358: Linux Kernel Race Condition Vulnerability

CVE-2026-43358 Overview

CVE-2026-43358 is a medium severity vulnerability in the Linux kernel btrfs filesystem. The flaw resides in the try_release_subpage_extent_buffer() function, where an error path exits a loop without calling rcu_read_lock() before a subsequent rcu_read_unlock() past the loop. The imbalance was identified by the Clang thread-safety analyzer. Exploitation requires local, low-privileged access and can lead to high availability impact on the affected system. No confidentiality or integrity impact is associated with this issue.

Critical Impact
A local attacker with low privileges can trigger an RCU (Read-Copy-Update) locking imbalance in the btrfs filesystem, potentially leading to kernel instability or denial of service.

Affected Products

Linux kernel 6.17 (including release candidates rc2 through rc7)
Linux kernel 7.0 release candidates rc1, rc2, and rc3
Systems using the btrfs filesystem on the affected kernel versions

Discovery Timeline

2026-05-08 - CVE-2026-43358 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43358

Vulnerability Analysis

The vulnerability is in the btrfs filesystem code, specifically the try_release_subpage_extent_buffer() function. The function uses RCU (Read-Copy-Update) synchronization to safely iterate over extent buffers. When the loop exits through an error path, the code reaches a rcu_read_unlock() call without a corresponding rcu_read_lock() having been issued. This produces an RCU locking imbalance.

The Clang thread-safety analyzer detected the missing lock acquisition during static analysis. The fix re-acquires the RCU read lock before exiting the loop so that the trailing rcu_read_unlock() operates on a properly held lock.

Root Cause

The root cause is improper RCU lock state management in an error path within try_release_subpage_extent_buffer(). A loop exit branch fails to call rcu_read_lock() before transferring control to code that unconditionally calls rcu_read_unlock(). This pairing mismatch corrupts the per-task RCU read-side critical section accounting and can destabilize RCU grace-period processing on the system [CWE-667 class locking issue, mapped as NVD-CWE-noinfo].

Attack Vector

The attack vector is local. A low-privileged user able to trigger the relevant btrfs code path on a vulnerable kernel can induce the RCU imbalance, with potential impact on kernel availability. Network exploitation is not possible, and no user interaction is required beyond local filesystem operations. No public proof-of-concept or active exploitation has been reported, and the EPSS percentile indicates a low likelihood of exploitation in the near term.

No verified exploitation code is available; technical details are documented in the upstream kernel commits referenced in the Kernel Git Commit 35b0c87, Kernel Git Commit 5e1ab71, and Kernel Git Commit b2840e3.

Detection Methods for CVE-2026-43358

Indicators of Compromise

Unexpected kernel warnings or splats referencing RCU, rcu_read_unlock, or btrfs functions such as try_release_subpage_extent_buffer.
Kernel logs showing suspicious RCU usage messages on systems with btrfs mounts.
Sudden hangs or soft lockups during btrfs page-release operations under memory pressure.

Detection Strategies

Inventory running kernel versions and flag hosts running Linux 6.17 or 7.0 release candidates with btrfs filesystems mounted.
Enable kernel lock debugging features such as CONFIG_PROVE_RCU and CONFIG_DEBUG_LOCK_ALLOC in test environments to surface RCU imbalances.
Correlate dmesg output with telemetry from EDR agents to identify kernel stability events linked to btrfs activity.

Monitoring Recommendations

Forward kernel log events to a centralized log platform and alert on RCU and btrfs error signatures.
Track btrfs subsystem stability metrics, including filesystem stalls and unexpected unmounts, on hosts running affected kernels.
Monitor patch deployment status across the Linux fleet to confirm remediation coverage.

How to Mitigate CVE-2026-43358

Immediate Actions Required

Identify all Linux systems running kernel versions 6.17 or 7.0 release candidates with btrfs in use.
Apply the stable kernel updates referenced in the upstream commits as soon as they are available from your distribution.
Restrict local shell access on multi-user systems where patching cannot be completed immediately.

Patch Information

The fix adds the missing rcu_read_lock() call before exiting the loop in try_release_subpage_extent_buffer(), restoring proper pairing with the trailing rcu_read_unlock(). The upstream patches are available at Kernel Git Commit 35b0c87, Kernel Git Commit 5e1ab71, and Kernel Git Commit b2840e3. Apply the corresponding stable kernel release from your Linux distribution vendor.

Workarounds

Limit use of btrfs on affected pre-release kernels until a patched kernel is deployed.
Reduce local user privileges and constrain access to filesystem operations on shared systems.
Pin production workloads to a stable, patched long-term support kernel rather than 6.17 or 7.0 release candidates.

bash

# Verify the running kernel version and btrfs usage
uname -r
mount | grep btrfs

# After updating the kernel package, reboot into the patched kernel
sudo reboot