CVE-2026-45934 Overview
CVE-2026-45934 affects the Linux kernel's btrfs filesystem implementation. The vulnerability stems from non-consecutive gaps in chunk allocation that trigger an EEXIST transaction abort in insert_dev_extents() called from btrfs_create_pending_block_groups(). Inspecting affected systems revealed overlapping chunk_maps where stripe 1 of one chunk overlaps in physical address with stripe 0 of the next chunk. The flaw can theoretically affect any DUP chunk allocation but is most frequently observed during forced chunk allocation paths under CONFIG_BTRFS_EXPERIMENTAL. The result is a transaction abort with errno=-17 (Object already exists) and forced filesystem error state.
Critical Impact
Transaction aborts caused by overlapping btrfs chunk maps place the filesystem into an error state, disrupting availability on affected Linux systems.
Affected Products
- Linux kernel btrfs subsystem
- Kernel versions including 6.19.0-rc6 (as referenced in the reported stack trace)
- Systems using DUP chunk allocation or forced chunk allocation paths
Discovery Timeline
- 2026-05-27 - CVE-2026-45934 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45934
Vulnerability Analysis
The issue manifests inside btrfs_create_pending_block_groups() when the kernel attempts to insert device extents for newly allocated chunks. When two chunks are allocated with non-consecutive gaps, their stripes can be mapped to overlapping physical address ranges on the underlying device. The duplicate device extent then fails insertion with -EEXIST, triggering BTRFS: Transaction aborted (error -17) at fs/btrfs/block-group.c:2876.
The reported drgn inspection showed two META|DUP chunks where the physical extent 0x142500000–0x182500000 was assigned both to stripe 1 of one chunk and stripe 0 of the following chunk. Because btrfs requires unique device extent ranges, the second insertion is rejected and the transaction is aborted, leaving the filesystem in an error state.
Root Cause
The defect lies in how the chunk allocator selects free space ranges on a device when prior allocations leave non-consecutive gaps. The allocator can re-select a physical range already covered by a previously allocated stripe, producing overlapping chunk maps. This is a filesystem logic flaw in the btrfs chunk allocation path rather than a memory safety issue.
Attack Vector
The condition is triggered by normal filesystem operations that drive chunk allocation, including operations that invoke btrfs_force_chunk_alloc_store() via sysfs writes. No remote vector is described in the upstream report. The impact is local denial of service through transaction abort and filesystem error state on affected mounts.
The vulnerability is documented through the upstream fix commits. See the kernel patch 156cac365e27, kernel patch 7d4eadee7042, and kernel patch b14c5e04bd0f for the source-level changes.
Detection Methods for CVE-2026-45934
Indicators of Compromise
- Kernel log entries containing BTRFS: Transaction aborted (error -17) referencing btrfs_create_pending_block_groups.
- Warnings at fs/btrfs/block-group.c:2876 with errno=-17 Object already exists.
- Filesystem transitioning to error state (state A) shortly after chunk allocation activity.
Detection Strategies
- Monitor dmesg and journalctl -k for btrfs transaction abort warnings tied to insert_dev_extents or btrfs_force_chunk_alloc_store.
- Use drgn or btrfs inspect-internal dump-tree to detect overlapping device extents across chunk maps on suspect filesystems.
- Track kernel version and configuration to identify hosts running builds with CONFIG_BTRFS_EXPERIMENTAL enabled.
Monitoring Recommendations
- Alert on btrfs filesystems entering error state across the fleet using telemetry from system logs.
- Capture stack traces involving btrfs_create_pending_block_groups+0x721/0x770 for forensic review.
- Correlate forced chunk allocation events written through sysfs with subsequent abort messages.
How to Mitigate CVE-2026-45934
Immediate Actions Required
- Apply the upstream btrfs fixes referenced in the kernel.org commits and rebuild affected kernels.
- Avoid enabling CONFIG_BTRFS_EXPERIMENTAL on production systems until patched kernels are deployed.
- Refrain from manually invoking forced chunk allocation through sysfs on affected kernels.
Patch Information
The fix is delivered through three upstream commits: 156cac365e27, 7d4eadee7042, and b14c5e04bd0f. These commits adjust chunk allocation so device extents are not assigned to overlapping physical ranges when prior allocations leave non-consecutive gaps. Distribution kernel maintainers will backport these changes to supported stable branches.
Workarounds
- Restrict write access to the btrfs sysfs interface that triggers forced chunk allocation (force_chunk_alloc).
- Recover impacted filesystems by unmounting, running btrfs check, and remounting after applying the patched kernel.
- Maintain current snapshots and backups before performing operations that drive significant chunk allocation activity.
# Verify running kernel and inspect btrfs abort messages
uname -r
dmesg | grep -i 'btrfs.*Transaction aborted'
journalctl -k -g 'insert_dev_extents'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
