CVE-2026-23181 - Vulnerability Details

- btrfs: sync read disk super and set block size

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: sync read disk super and set block size

When the user performs a btrfs mount, the block device is not set
correctly. The user sets the block size of the block device to 0x4000
by executing the BLKBSZSET command.
Since the block size change also changes the mapping->flags value, this
further affects the result of the mapping_min_folio_order() calculation.

Let's analyze the following two scenarios:

Scenario 1: Without executing the BLKBSZSET command, the block size is
0x1000, and mapping_min_folio_order() returns 0;

Scenario 2: After executing the BLKBSZSET command, the block size is
0x4000, and mapping_min_folio_order() returns 2.

do_read_cache_folio() allocates a folio before the BLKBSZSET command
is executed. This results in the allocated folio having an order value
of 0. Later, after BLKBSZSET is executed, the block size increases to
0x4000, and the mapping_min_folio_order() calculation result becomes 2.

This leads to two undesirable consequences:

1. filemap_add_folio() triggers a VM_BUG_ON_FOLIO(folio_order(folio) <
mapping_min_folio_order(mapping)) assertion.

2. The syzbot report [1] shows a null pointer dereference in
create_empty_buffers() due to a buffer head allocation failure.

Synchronization should be established based on the inode between the
BLKBSZSET command and read cache page to prevent inconsistencies in
block size or mapping flags before and after folio allocation.

[1]
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:create_empty_buffers+0x4d/0x480 fs/buffer.c:1694
Call Trace:
folio_create_buffers+0x109/0x150 fs/buffer.c:1802
block_read_full_folio+0x14c/0x850 fs/buffer.c:2403
filemap_read_folio+0xc8/0x2a0 mm/filemap.c:2496
do_read_cache_folio+0x266/0x5c0 mm/filemap.c:4096
do_read_cache_page mm/filemap.c:4162 [inline]
read_cache_page_gfp+0x29/0x120 mm/filemap.c:4195
btrfs_read_disk_super+0x192/0x500 fs/btrfs/volumes.c:1367

Published: 2026-02-14

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw allows a local user to change a block device’s size via the BLKBSZSET ioctl while a Btrfs file system is mounted. This adjustment alters the mapping flags used by the kernel’s block request logic, causing the calculated minimum folio order to increase. The result is that folios allocated before size change are considered too small, triggering kernel assertions and a null–pointer dereference in create_empty_buffers(). The error manifests as a kernel oops, effectively crashing the system and denying service.

Affected Systems

All Linux kernel releases that contain the flawed Btrfs code path and do not yet include the patch for CVE-2026-23181. The exact affected kernel versions are not listed, so any unpatched kernel that supports Btrfs is at risk.

Risk and Exploitability

The vulnerability is scored with a CVSS of 7.0 (High) and an EPSS of <1%, indicating a low likelihood of widespread exploitation at this time. It is a local privilege issue: the attacker must have the ability to issue BLKBSZSET on a block device used by a mounted Btrfs volume, which typically requires root privileges or device‑mngmt access. The attack does not require network exposure, but can be performed by any privileged user. The victim’s confidentiality and integrity remain unchanged; the primary consequence is a system crash and interruption of services.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3c20917120ce61f2a123ca0810293872f4c6b5a4`	affected	< ccb3c75d57039adb3170ae54a0d470e359705984
`3c20917120ce61f2a123ca0810293872f4c6b5a4`	affected	< 3f29d661e5686f3aa14e6f11537ff5c49846f2e2

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.18.10`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

—

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ccb3c75d57039adb3170ae54a0d470e359705984)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3f29d661e5686f3aa14e6f11537ff5c49846f2e2)`	affected	code_commit	—

Linux

Linux Kernel

—

Version	Status	Scheme	Platform
`[6.18.10,6.19.0)`	unaffected	semver	—
`[6.19,*)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the vendor patch for CVE-2026-23181.
If an immediate kernel update is not possible, avoid using BLKBSZSET on block devices that host Btrfs filesystems or perform the size change only when the filesystem is unmounted.
Implement access controls to restrict BLKBSZSET to trusted users and monitor for KASAN OOPS messages that may indicate an ongoing exploit.

Generated by OpenCVE AI on April 17, 2026 at 19:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00026.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3f29d661e5686f3aa14e6f11537ff5c49846f2e2
https://git.kernel.org/stable/c/ccb3c75d57039adb3170ae54a0d470e359705984
https://lore.kernel.org/linux-cve-announce/2026021429-CVE-2026-23181-7c82@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23181
https://www.cve.org/CVERecord?id=CVE-2026-23181

History

Fri, 17 Apr 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-476

Mon, 16 Feb 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021429-CVE-2026-23181-7c82@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23181 https://www.cve.org/CVERecord?id=CVE-2026-23181
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 14 Feb 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: btrfs: sync read disk super and set block size When the user performs a btrfs mount, the block device is not set correctly. The user sets the block size of the block device to 0x4000 by executing the BLKBSZSET command. Since the block size change also changes the mapping->flags value, this further affects the result of the mapping_min_folio_order() calculation. Let's analyze the following two scenarios: Scenario 1: Without executing the BLKBSZSET command, the block size is 0x1000, and mapping_min_folio_order() returns 0; Scenario 2: After executing the BLKBSZSET command, the block size is 0x4000, and mapping_min_folio_order() returns 2. do_read_cache_folio() allocates a folio before the BLKBSZSET command is executed. This results in the allocated folio having an order value of 0. Later, after BLKBSZSET is executed, the block size increases to 0x4000, and the mapping_min_folio_order() calculation result becomes 2. This leads to two undesirable consequences: 1. filemap_add_folio() triggers a VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) assertion. 2. The syzbot report [1] shows a null pointer dereference in create_empty_buffers() due to a buffer head allocation failure. Synchronization should be established based on the inode between the BLKBSZSET command and read cache page to prevent inconsistencies in block size or mapping flags before and after folio allocation. [1] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:create_empty_buffers+0x4d/0x480 fs/buffer.c:1694 Call Trace: folio_create_buffers+0x109/0x150 fs/buffer.c:1802 block_read_full_folio+0x14c/0x850 fs/buffer.c:2403 filemap_read_folio+0xc8/0x2a0 mm/filemap.c:2496 do_read_cache_folio+0x266/0x5c0 mm/filemap.c:4096 do_read_cache_page mm/filemap.c:4162 [inline] read_cache_page_gfp+0x29/0x120 mm/filemap.c:4195 btrfs_read_disk_super+0x192/0x500 fs/btrfs/volumes.c:1367
Title		btrfs: sync read disk super and set block size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3f29d661e5686f3aa14e6f11537ff5c49846f2e2 https://git.kernel.org/stable/c/ccb3c75d57039adb3170ae54a0d470e359705984

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-02-14T16:27:12.137Z

Updated: 2026-02-16T08:58:53.981Z

Reserved: 2026-01-13T15:37:45.984Z

Link: CVE-2026-23181

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-02-14T17:15:55.853

Modified: 2026-04-15T14:34:27.800

Link: CVE-2026-23181

Redhat

Severity : Moderate

Publid Date: 2026-02-14T00:00:00Z

Links: CVE-2026-23181 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-17T19:30:15Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object