CVE-2026-43359 Overview
CVE-2026-43359 is a local denial-of-service vulnerability in the Linux kernel's btrfs filesystem. The flaw resides in the BTRFS_IOC_SET_RECEIVED_SUBVOL ioctl handler, which fails to validate item space before starting a transaction. When the ioctl attempts to add a BTRFS_UUID_KEY_RECEIVED_SUBVOL entry and hits an item overflow, the kernel aborts the active transaction after metadata has already been updated. This forces the filesystem into read-only mode.
The ioctl does not require CAP_SYS_ADMIN. Any local user who owns a subvolume can trigger the abort by repeatedly invoking the ioctl with the same received UUID across many subvolumes.
Critical Impact
A local unprivileged user who owns a subvolume can force a btrfs filesystem into read-only state, causing a system-wide denial of service.
Affected Products
- Linux kernel mainline 7.0-rc1, 7.0-rc2, and 7.0-rc3
- Multiple stable Linux kernel branches prior to the fix commits
- Distributions shipping btrfs with the vulnerable set_received_subvol code path
Discovery Timeline
- 2026-05-08 - CVE-2026-43359 published to NVD
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-43359
Vulnerability Analysis
The btrfs set_received_subvol ioctl records that a subvolume has been received from another filesystem. As part of this operation, the kernel inserts a UUID tree item keyed by BTRFS_UUID_KEY_RECEIVED_SUBVOL. The original implementation started a transaction and modified subvolume root metadata before attempting the UUID item insertion.
When many subvolumes share the same received UUID value, the corresponding UUID tree node accumulates entries until the leaf can no longer hold another item. The insertion then returns an overflow error. Because metadata updates have already occurred, the kernel must call btrfs_abort_transaction(), which flips the filesystem to read-only to preserve consistency.
The vulnerability is classified as [CWE-191] Integer Underflow in the NVD record, reflecting the boundary miscalculation that occurs when computing remaining item space.
Root Cause
The root cause is missing pre-validation of UUID tree capacity before transaction start. The code path performed an item space check only after committing to metadata updates, leaving the abort path as the only safe recovery option on overflow.
Attack Vector
Exploitation requires local access and ownership of at least one subvolume. An attacker creates or owns multiple subvolumes and invokes BTRFS_IOC_SET_RECEIVED_SUBVOL with an identical uuid field on each. Once the UUID tree leaf fills, the next ioctl call triggers the overflow, the transaction aborts, and the entire btrfs mount becomes read-only until remount or reboot. The fix moves the overflow check ahead of the transaction start and relies on the subvol_sem semaphore held in exclusive mode to remain race-free.
Detection Methods for CVE-2026-43359
Indicators of Compromise
- Kernel log entries containing BTRFS: error followed by Transaction aborted referencing the UUID tree or btrfs_uuid_tree_add
- Filesystem transitioning to read-only state with BTRFS info: forced readonly messages in dmesg
- High-frequency ioctl calls with BTRFS_IOC_SET_RECEIVED_SUBVOL from non-root users in audit logs
Detection Strategies
- Monitor dmesg and /var/log/kern.log for btrfs transaction abort messages combined with read-only remount events
- Enable Linux audit rules on the ioctl syscall filtered to btrfs file descriptors to identify abnormal call volume per user
- Correlate subvolume creation bursts with subsequent set_received_subvol invocations originating from the same UID
Monitoring Recommendations
- Alert on any unscheduled btrfs filesystem transition to read-only on production hosts
- Track per-user ioctl rates against btrfs mounts and flag rates exceeding normal backup or send/receive workflows
- Capture full kernel ring buffer contents during incident triage to confirm the abort originated in btrfs_ioctl_set_received_subvol
How to Mitigate CVE-2026-43359
Immediate Actions Required
- Apply the upstream stable kernel updates that include the early overflow check in btrfs_ioctl_set_received_subvol
- Restrict creation of btrfs subvolumes by unprivileged users on multi-tenant systems until patches are deployed
- Audit existing UUID tree contents and identify subvolumes sharing identical received UUIDs
Patch Information
The fix has been merged across multiple stable branches. Relevant commits include Kernel Patch Commit 2e57b8ca, Kernel Patch Commit 41fb9735, Kernel Patch Commit 87f2c460, Kernel Patch Commit b19c0465, Kernel Patch Commit b9914db1, and Kernel Patch Commit d11aefe6. Each patch performs the UUID item overflow check before starting the transaction while holding subvol_sem exclusively.
Workarounds
- Disallow unprivileged subvolume ownership by mounting btrfs with restricted user permissions on shared systems
- Limit access to the BTRFS_IOC_SET_RECEIVED_SUBVOL ioctl using a seccomp filter for untrusted processes
- Monitor and rate-limit subvolume creation per non-root user to reduce the practical attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
