CVE-2026-64593 Overview
CVE-2026-64593 is a NULL pointer dereference vulnerability in the Linux kernel's btrfs filesystem. The flaw resides in the device trim path, specifically inside btrfs_trim_free_extents_throttle(), which calls bdev_max_discard_sectors(device->bdev) without verifying that the block device pointer is valid. A local user issuing an FITRIM ioctl (for example, through fstrim) on a btrfs volume can trigger a kernel crash when a previously missing device has been re-scanned but not fully re-initialized.
Critical Impact
A local invocation of fstrim against a degraded btrfs filesystem can dereference a NULL device->bdev pointer, causing a kernel oops and denial of service.
Affected Products
- Linux kernel btrfs filesystem (multiple stable branches receiving backports)
- Distributions shipping affected kernels, including openSUSE Tumbleweed (kernel 7.0.10-2-default referenced in the report)
- Any system mounting btrfs volumes in degraded mode where a missing device may reappear
Discovery Timeline
- 2026-08-06 - CVE-2026-64593 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-64593
Vulnerability Analysis
The vulnerability is a NULL Pointer Dereference in the btrfs discard path. When fstrim invokes the btrfs_ioctl_fitrim ioctl, execution reaches btrfs_trim_fs() → btrfs_trim_free_extents() → btrfs_trim_free_extents_throttle(). This function calls bdev_max_discard_sectors(device->bdev) on each device in the filesystem. The trim path filters out devices with the BTRFS_DEV_STATE_MISSING flag, but does not verify that device->bdev is non-NULL or that BTRFS_DEV_STATE_WRITEABLE is set. When these assumptions fail, the kernel dereferences a NULL pointer and oopses.
The reporter confirmed the state at crash time by adding an assertion in btrfs_trim_free_extents_throttle(), which produced: devid=2 path=/dev/sdd dev_state=0x82. The state bits correspond to BTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND without BTRFS_DEV_STATE_WRITEABLE, and device->bdev is NULL.
Root Cause
The root cause is a desynchronization between the BTRFS_DEV_STATE_MISSING flag and the device->bdev pointer. When a previously missing device is re-scanned through btrfs_control_ioctl() → btrfs_scan_one_device() → device_list_add(), btrfs updates the device name with rcu_assign_pointer(device->name, name) and clears the missing flag with clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state). However, the code path does not open the block device, so device->bdev remains NULL and BTRFS_DEV_STATE_WRITEABLE is never set. The trim path then treats the device as usable.
Attack Vector
An attacker requires local access and the ability to trigger FITRIM on a btrfs mount, typically via fstrim. The condition arises on filesystems mounted in degraded mode where a missing device is later re-scanned. On systems with automated trim timers (fstrim.timer), the crash can occur without direct user action. The result is a kernel NULL pointer dereference leading to denial of service. No remote attack vector or code execution primitive is described in the advisory.
The upstream fix skips any device that does not have BTRFS_DEV_STATE_WRITEABLE set inside the trim path, preventing the NULL bdev dereference until btrfs's re-appearing-device handling is fully corrected.
Detection Methods for CVE-2026-64593
Indicators of Compromise
- Kernel oops messages referencing btrfs_trim_fs+0x34c/0xa00 or btrfs_trim_free_extents_throttle in dmesg or /var/log/kern.log
- Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 originating from the btrfs module
- BTRFS warnings such as devid <N> uuid <uuid> is missing followed by successful device re-scan events
- fstrim processes terminating abnormally or leaving the filesystem in an inconsistent state
Detection Strategies
- Monitor kernel ring buffer for btrfs-related NULL pointer dereferences and correlate with recent FITRIM ioctl activity
- Audit systemd fstrim.timer and fstrim.service execution logs on hosts running btrfs in degraded mode
- Track kernel version inventory to identify hosts running vulnerable btrfs code prior to the referenced stable patches
Monitoring Recommendations
- Alert on any btrfs device missing warning that is followed by device re-scan events without a subsequent remount
- Ingest /var/log/kern.log and journald into a central log store and match against oops signatures involving the btrfs module
- Track systems mounting btrfs with the degraded option and flag them for expedited patching
How to Mitigate CVE-2026-64593
Immediate Actions Required
- Apply the upstream stable-kernel patches referenced by the btrfs trim fix commit 210af872 and its sibling backports across supported branches
- Update to a distribution kernel that includes the btrfs do not trim a device which is not writeable fix
- Disable automatic fstrim.timer on hosts running btrfs in degraded mode until patched
Patch Information
The fix has been merged into multiple stable kernel branches. Relevant commits include 02c903fc, 1b1937eb, 210af872, 3d8fa4b8, 7a645218, 9c894159, b4af31b8, and f41ae7e6. The patch adds a BTRFS_DEV_STATE_WRITEABLE check before invoking discard on a device.
Workarounds
- Avoid running fstrim on btrfs filesystems that are or have been mounted with the degraded option
- Remount the filesystem cleanly after a missing device is restored, so device->bdev is properly initialized before any trim operation
- Mask the fstrim.timer unit on affected hosts with systemctl mask fstrim.timer until the patched kernel is deployed
# Disable scheduled trim on affected btrfs hosts until patched
sudo systemctl stop fstrim.timer
sudo systemctl mask fstrim.timer
# Verify running kernel version
uname -r
# Confirm no btrfs volumes are mounted degraded
mount | grep btrfs | grep -i degraded
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
