CVE-2026-43360: Linux Kernel DOS Vulnerability

CVE-2026-43360 Overview

CVE-2026-43360 is a denial-of-service vulnerability in the Btrfs filesystem within the Linux kernel. The flaw triggers a transaction abort when an unprivileged user creates multiple files with names producing identical CRC32C hashes within the same directory. Once the directory item exceeds the leaf size limit, Btrfs aborts the transaction and remounts the filesystem as read-only. A local user can disrupt system availability without administrative privileges or capabilities. The issue affects multiple Linux kernel branches including the 7.0 release candidates.

Critical Impact
Local unprivileged users can force the Btrfs filesystem into read-only mode, causing service disruption on affected systems.

Affected Products

Linux Kernel (multiple stable branches)
Linux Kernel 7.0-rc1
Linux Kernel 7.0-rc2 and 7.0-rc3

Discovery Timeline

2026-05-08 - CVE-2026-43360 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43360

Vulnerability Analysis

The vulnerability resides in the Btrfs directory entry handling logic. Btrfs uses CRC32C hashes to index file names within directory items. When multiple file names produce identical hashes, the filesystem packs them into the same dir item structure. This structure is constrained by the filesystem leaf size.

When the accumulated entries exceed the leaf size, Btrfs invokes a transaction abort. The abort path transitions the filesystem to read-only mode to protect data integrity. However, the abort is triggered by user-controllable input rather than corruption, allowing any local user with write access to a Btrfs directory to disrupt the system.

The proof-of-concept distributed with the upstream advisory demonstrates the issue using approximately 28 specifically crafted file names that collide under CRC32C. With the smallest 4K node size, the threshold is reached quickly. The vulnerability is classified under [NVD-CWE-noinfo] and tracks as a local availability impact.

Root Cause

The root cause is improper error handling for an expected, user-reachable condition. Reaching the dir item size limit through hash collisions should return an error to userspace rather than aborting the entire transaction. The filesystem treats a recoverable input-driven boundary as a fatal corruption event.

Attack Vector

Exploitation requires local access and write permission to any directory on a Btrfs filesystem. The attacker creates a sequence of files whose names hash to the same CRC32C value. After enough colliding entries are inserted, the next create() syscall triggers the transaction abort. The filesystem remounts read-only, blocking writes from all users and processes until a remount or reboot is performed. No kernel exploits or privilege escalation primitives are reported for this issue.

The vulnerability mechanism is described in prose only because no verified exploit code beyond the upstream reproducer script is publicly catalogued. See the kernel commit references for the upstream patch details.

Detection Methods for CVE-2026-43360

Indicators of Compromise

Kernel log messages indicating BTRFS: Transaction aborted with an error code from the directory item insertion path.
Sudden transition of a mounted Btrfs filesystem to read-only state without underlying hardware errors.
Process activity creating large numbers of files with long, high-entropy names in a single directory by a non-privileged user.

Detection Strategies

Monitor dmesg and /var/log/kern.log for btrfs_abort_transaction traces correlated with directory operations.
Audit creat, openat, and mknod syscalls for bursts of file creation from unprivileged UIDs in shared directories.
Track filesystem mount-state changes using inotify or systemd journal events for read-only transitions.

Monitoring Recommendations

Enable kernel audit rules for file creation events in world-writable and user-home directories on Btrfs volumes.
Alert on any Btrfs transaction abort event, as these are operationally significant regardless of cause.
Baseline normal file creation rates per user and flag anomalous bursts that may indicate hash-collision abuse.

How to Mitigate CVE-2026-43360

Immediate Actions Required

Apply the upstream Btrfs patches referenced in the kernel stable tree commits as soon as your distribution publishes updated packages.
Restrict write access to shared Btrfs directories for untrusted local users until kernels are patched.
Review multi-tenant systems and containers that share Btrfs volumes for exposure to local accounts.

Patch Information

The fix is committed across multiple stable kernel branches. Reference commits include 0625e564, 2d1ababd, 36947b52, 5e2ea10b, 64ad4959, and 9273175b. See the Kernel Git Commit 9273175b and the Kernel Git Commit 0625e564 for upstream details. Update to a kernel build that includes these commits via your distribution's security channel.

Workarounds

Mount shared Btrfs filesystems with stricter directory permissions and use per-user subvolumes to limit blast radius.
Apply filesystem quotas and per-user RLIMIT_NOFILE plus directory ACLs to slow file creation by untrusted users.
Consider relocating multi-tenant workloads to a different filesystem until patched kernels are deployed.

bash

# Verify running kernel and check for the fix
uname -r
# Restrict write access on shared Btrfs directories
chmod 1755 /shared/btrfs/dir
# Inspect Btrfs filesystem state for read-only transition
dmesg | grep -i 'btrfs.*abort\|remount.*read-only'