CVE-2026-45974: Linux Kernel Privilege Escalation Flaw

CVE-2026-45974 Overview

CVE-2026-45974 is a Linux kernel vulnerability in the Btrfs filesystem implementation. The flaw resides in the btrfs_quota_enable() function, which fails to handle a specific return condition from btrfs_search_slot_for_read(). When that helper returns 1, it signals that no key greater than or equal to the requested key was found and that the tree traversal reached the end. The existing code did not break out of the loop in this scenario, allowing execution to continue and access an invalid path. This results in invalid leaf access within kernel memory when enabling Btrfs quotas.

Critical Impact
Invalid leaf access in the kernel can cause memory corruption or system instability when a user with privileges to enable Btrfs quotas triggers the code path.

Affected Products

Linux kernel (Btrfs filesystem subsystem)
Distributions shipping vulnerable kernel versions with Btrfs enabled
Systems using Btrfs quotas via btrfs quota enable

Discovery Timeline

2026-05-27 - CVE-2026-45974 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45974

Vulnerability Analysis

The vulnerability exists in the Btrfs quota enablement path in the Linux kernel. btrfs_quota_enable() walks the extent tree using btrfs_search_slot_for_read() to locate reference keys. The helper function returns 0 when a matching or larger key is found, a negative value on error, and 1 when no such key exists because the search reached the end of the tree.

The original implementation did not treat the return value of 1 as a terminal condition. Execution continued through the loop and dereferenced path components that were not populated with valid leaf data. This led to an invalid leaf access in kernel context. The fix introduces an explicit break when the helper returns 1, halting iteration before any invalid path data is used.

Root Cause

The root cause is missing handling of the end-of-tree return value from btrfs_search_slot_for_read(). The loop body assumed a valid path on any non-negative return, conflating success (0) with end-of-tree (1). This is a logic error rather than a memory-safety primitive on its own, but it leads to out-of-bounds or stale-pointer reads against the path structure.

Attack Vector

Triggering the code path requires the ability to enable quotas on a Btrfs volume, an operation generally restricted to privileged users or containers with mounted Btrfs subvolumes. An attacker with such access can craft or interact with a filesystem state where the reference key search reaches the end of the tree, inducing invalid memory access in kernel space.

No verified public exploit code is available. See the upstream kernel commits in the Linux stable tree for the fix details.

Detection Methods for CVE-2026-45974

Indicators of Compromise

Kernel BUG, WARN, or Oops messages referencing btrfs_quota_enable in dmesg or journalctl -k output.
Unexpected kernel panics correlated with btrfs quota enable invocations.
Audit log entries showing privileged users issuing btrfs qgroup or quota enablement commands on suspect volumes.

Detection Strategies

Inventory running kernel versions across Linux hosts and compare against patched stable releases referenced in the upstream commits.
Monitor for execution of btrfs quota enable on production hosts where quotas are not part of the operational baseline.
Correlate kernel oops events with preceding Btrfs administrative commands for forensic context.

Monitoring Recommendations

Centralize kernel logs and alert on btrfs_* stack traces.
Track uname -r and package versions of linux-image or distribution kernel packages via configuration management.
Flag any unprivileged-to-privileged transitions followed by Btrfs administrative operations.

How to Mitigate CVE-2026-45974

Immediate Actions Required

Apply the kernel update from your Linux distribution that includes the upstream Btrfs fix for btrfs_quota_enable().
Restrict access to Btrfs administrative operations to trusted operators and constrain container privileges that allow filesystem mounting.
Audit hosts currently running Btrfs with quotas enabled and prioritize them for patching.

Patch Information

The vulnerability is resolved by stable kernel commits including ecb7c2484cfc, b5b8ade9da45, 023545e272f3, 0761447f6f51, 1ee1d006c9fe, b2bd557b75b7, d7cf2314dd5e, and fd4913a53e3b. References are available in the Linux kernel stable git tree. Install the kernel package version provided by your distribution that incorporates these commits and reboot to load the patched kernel.

Workarounds

Disable Btrfs quotas with btrfs quota disable <path> on volumes where quotas are not required until patches are applied.
Avoid mounting untrusted Btrfs images and limit CAP_SYS_ADMIN in containerized environments.
Where feasible, migrate workloads off Btrfs volumes that require quota enablement until the kernel is updated.

bash

# Verify kernel version and disable Btrfs quotas on a mounted volume
uname -r
sudo btrfs quota disable /mnt/data