CVE-2026-68167 Overview
CVE-2026-68167 is a Linux kernel vulnerability in the btrfs filesystem. The flaw affects the data relocation code path, where the kernel incorrectly attempts to inline-compress the first block of a data reloc inode. This produces an inlined file extent in the data reloc tree, which violates btrfs invariants. When the relocation code later calls get_new_location(), it encounters an unexpected non-zero offset and triggers a kernel abort. A syzbot fuzzer reproduced the condition. The upstream fix disables compression for data reloc inodes so can_cow_file_range_inline() returns false and no inline extent is created.
Critical Impact
Local users triggering btrfs balance or relocation workloads can crash the kernel through an assertion failure in the filesystem code.
Affected Products
- Linux kernel (btrfs filesystem subsystem)
- Distributions shipping the affected upstream kernel prior to the fix
- Systems using btrfs with balance or data relocation operations enabled
Discovery Timeline
- 2026-08-10 - CVE-2026-68167 published to the National Vulnerability Database
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68167
Vulnerability Analysis
The vulnerability is a kernel filesystem logic error [Kernel Vulnerability] in the btrfs data relocation path. Data reloc inodes are internal btrfs constructs that represent where data extents live in the relocation destination chunk. These inodes must never contain inlined extent data because their purpose is to track block-aligned data extents during balance operations.
The relocation path preallocates space for each block, then dirties them cluster by cluster. When only a single block sits at the beginning of a block group with no other block in the same cluster, relocation preallocates a file extent and dirties that first block. Memory pressure can then force the data reloc inode to be written back before any subsequent blocks are dirtied or allocated.
Root Cause
Commit 3eaf5f082c4c ("btrfs: extract inlined creation into a dedicated delalloc helper") changed the delalloc sequence. The previous code always attempted NOCOW first, causing the dirtied block to land in the preallocated space as a regular extent. After the change, the code attempts inline creation first. Because compression is forced for the relocation inode, the kernel compresses the single block and inlines the compressed data, producing an inline file extent inside the data reloc tree.
Attack Vector
The check inside get_new_location() validates file offset without confirming whether the extent is inlined. Encountering an inlined extent triggers btrfs_abort_should_print_stack() and aborts the transaction. A local user with the ability to trigger btrfs balance operations on a crafted or fuzzed filesystem image can reach the abort path. See the Kernel.org commit details for the fix, which prevents compression on data reloc inodes so data_len stays at least one block and inlining is skipped.
Detection Methods for CVE-2026-68167
Indicators of Compromise
- Kernel log entries containing BTRFS error and unexpected non-zero offset in file extent item for data reloc inode
- btrfs_abort_should_print_stack stack traces in dmesg output following balance or relocation operations
- Transaction aborts on btrfs filesystems coinciding with balance jobs under memory pressure
Detection Strategies
- Monitor kernel ring buffer and journalctl -k output for btrfs abort messages tied to data reloc inodes
- Correlate btrfs balance job execution with kernel panic or filesystem read-only remounts on affected hosts
- Track kernel version inventory to identify Linux systems running builds prior to the upstream patch commits
Monitoring Recommendations
- Ingest /var/log/kern.log and systemd journal data into a centralized log platform for filesystem error correlation
- Alert on filesystem transitions to read-only state, which follow btrfs transaction aborts
- Track balance operation success and failure metrics on production btrfs volumes
How to Mitigate CVE-2026-68167
Immediate Actions Required
- Apply the upstream kernel patches referenced in the Kernel.org commit details as soon as distribution builds are available
- Restrict local user access to systems running btrfs with balance operations enabled until patches land
- Snapshot and back up production btrfs volumes before running relocation or balance jobs on unpatched kernels
Patch Information
The fix is committed upstream as 31a62e4ad66313cf1ebaa00c2a17d644a4b87d22 and ae4316f332e03e628712e9dfb89f2b7d3c70c21a. The patch disables compression for data reloc inodes. Because data reloc inode sizes are always block aligned, keeping compression off ensures data_len remains at least one block, which causes can_cow_file_range_inline() to return false and prevents inlined extents in the data reloc tree.
Workarounds
- Avoid running btrfs balance operations on affected kernels until patched builds are deployed
- Reduce memory pressure during relocation windows to lower the probability of triggering the writeback path that produces the inlined extent
- Consider migrating critical workloads to a filesystem or kernel build that does not exhibit the flaw until patches are applied
# Verify installed kernel version and check for the upstream fix
uname -r
git -C /usr/src/linux log --oneline | grep -E "31a62e4ad663|ae4316f332e0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
