CVE-2026-64593 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: do not trim a device which is not writeable

[BUG]
There is a bug report that btrfs/242 can randomly fail with the
following NULL pointer dereference:

run fstests btrfs/242 at 2026-06-01 10:25:08
BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609)
BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874
BTRFS info (device sdc): using crc32c checksum algorithm
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS info (device sdc): allowing degraded mounts
BTRFS info (device sdc): turning on async discard
BTRFS info (device sdc): enabling free space tree
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000
CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd
Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025
pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]
lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]
Call trace:
btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P)
btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
__arm64_sys_ioctl+0xac/0x108
invoke_syscall.constprop.0+0x5c/0xd0
el0_svc_common.constprop.0+0x40/0xf0
do_el0_svc+0x24/0x40
el0_svc+0x40/0x1d0
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)
---[ end trace 0000000000000000 ]---

Also the reporter is very kind to test the following ASSERT() added to
btrfs_trim_free_extents_throttle():

ASSERT(device->bdev,
"devid=%llu path=%s dev_state=0x%lx\n",
device->devid, btrfs_dev_name(device), device->dev_state);

And it shows the following output:

assertion failed: device->bdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82)

Which means the device->bdev is NULL, and the dev_state is
BTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND, without
BTRFS_DEV_STATE_WRITEABLE flag set.

[CAUSE]
The pc points to the following call chain:

btrfs_trim_fs()
|- btrfs_trim_free_extents()
|- btrfs_trim_free_extents_throttle()
|- bdev_max_discard_sectors(device->bdev)

So the NULL pointer dereference is caused by device->bdev being NULL.

This looks impossible by a quick glance, as just before calling
btrfs_trim_free_extents_throttle(), we have skipped any device that has
BTRFS_DEV_STATE_MISSING flag set.

However in this particular case, there is a window where the missing
device is later re-scanned, causing btrfs to remove the
BTRFS_DEV_STATE_MISSING flag:

btrfs_control_ioctl()
|- btrfs_scan_one_device()
|- device_list_add()
|- rcu_assign_pointer(device->name, name);
| This updates the missing device's path to the new good path.
|
|- clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)
This removes the BTRFS_DEV_STATE_MISSING flag.

This allows the missing device to re-appear and clear the
BTRFS_DEV_STATE_MISSING flag. However the device still does not have
the BTRFS_DEV_STATE_WRITEABLE flag set, nor is its bdev pointer updated.

The bdev pointer remains NULL, triggering the crash later.

[FIX]
This is a big de-synchronization between BTRFS_DEV_STATE_MISSING and
device->bdev pointer, and shows a gap in btrfs's re-appearing-device
handling.

The proper handling of re-appearing device will need quite some extra
work, which is out of the context of this small
---truncated---

Published: 2026-08-06

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a NULL pointer dereference in the btrfs_trim_fs path that is triggered when a previously missing BTRFS device reappears without its writeable flag set. The flaw ultimately causes an unintended kernel panic, which results in a denial of service for the affected system. According to the Common Weakness Enumeration, this is a CWE‑476 issue related to dereferencing a null pointer.

Affected Systems

All Linux kernel builds that include the btrfs filesystem, as the patch addresses kernel code. No specific version range is listed in the advisory, so all current and legacy releases may be impacted until the fix is applied.

Risk and Exploitability

The CVSS score and EPSS are not provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no public exploits are known. The flaw is limited to local or privileged users capable of issuing the fstrim ioctl on a btrfs volume. An attacker would need to trigger the trim operation on a filesystem containing a reappearing non‑writeable device to cause a kernel panic. Because the bug manifests only in a specific device state transition, its practical exploitability is considered moderate to low.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`499f377f49f085ee4aa214c738e948e88626f39b`	affected	< f41ae7e6664f3c4361129728f2c4d5f3ed995251
`499f377f49f085ee4aa214c738e948e88626f39b`	affected	< 210af872eafa0cf572a84cb303c0f9d2914c1226
`499f377f49f085ee4aa214c738e948e88626f39b`	affected	< 3d8fa4b828a86b33c60858e58aaab6df273ede05
`499f377f49f085ee4aa214c738e948e88626f39b`	affected	< 9c894159c5b8adc84072e3af0e55b0473a69564e
`499f377f49f085ee4aa214c738e948e88626f39b`	affected	< 02c903fc6fc7e16c5d1f22d18784f1208acf43e3
`499f377f49f085ee4aa214c738e948e88626f39b`	affected	< 7a64521802997257b144e6edfb4e278dbeb972dd
`499f377f49f085ee4aa214c738e948e88626f39b`	affected	< b4af31b898a948e29861cb0bae734058f9a49d9b
`499f377f49f085ee4aa214c738e948e88626f39b`	affected	< 1b1937eb08f51319bf71575484cde2b8c517aedc

Linux

affected

Version	Status	Constraints
`4.3`	affected	—
`0`	unaffected	< 4.3
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[499f377f49f085ee4aa214c738e948e88626f39b,f41ae7e6664f3c4361129728f2c4d5f3ed995251)`	affected	code_commit	—
`[499f377f49f085ee4aa214c738e948e88626f39b,210af872eafa0cf572a84cb303c0f9d2914c1226)`	affected	code_commit	—
`[499f377f49f085ee4aa214c738e948e88626f39b,3d8fa4b828a86b33c60858e58aaab6df273ede05)`	affected	code_commit	—
`[499f377f49f085ee4aa214c738e948e88626f39b,9c894159c5b8adc84072e3af0e55b0473a69564e)`	affected	code_commit	—
`[499f377f49f085ee4aa214c738e948e88626f39b,02c903fc6fc7e16c5d1f22d18784f1208acf43e3)`	affected	code_commit	—
`[499f377f49f085ee4aa214c738e948e88626f39b,7a64521802997257b144e6edfb4e278dbeb972dd)`	affected	code_commit	—
`[499f377f49f085ee4aa214c738e948e88626f39b,b4af31b898a948e29861cb0bae734058f9a49d9b)`	affected	code_commit	—
`[499f377f49f085ee4aa214c738e948e88626f39b,1b1937eb08f51319bf71575484cde2b8c517aedc)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.3`	affected	semver	—
`[0,4.3)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the commit fixing the btrfs trim NULL pointer dereference.
If a kernel upgrade is not immediately possible, disable btrfs discard or fstrim on affected volumes until the patch is applied.
After applying the patch, audit device management scripts to avoid reintroducing missing devices without properly setting the writeable flag.

Generated by OpenCVE AI on August 6, 2026 at 08:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00164.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/02c903fc6fc7e16c5d1f22d18784f1208acf43e3
https://git.kernel.org/stable/c/1b1937eb08f51319bf71575484cde2b8c517aedc
https://git.kernel.org/stable/c/210af872eafa0cf572a84cb303c0f9d2914c1226
https://git.kernel.org/stable/c/3d8fa4b828a86b33c60858e58aaab6df273ede05
https://git.kernel.org/stable/c/7a64521802997257b144e6edfb4e278dbeb972dd
https://git.kernel.org/stable/c/9c894159c5b8adc84072e3af0e55b0473a69564e
https://git.kernel.org/stable/c/b4af31b898a948e29861cb0bae734058f9a49d9b
https://git.kernel.org/stable/c/f41ae7e6664f3c4361129728f2c4d5f3ed995251

History

Thu, 06 Aug 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Thu, 06 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: btrfs: do not trim a device which is not writeable [BUG] There is a bug report that btrfs/242 can randomly fail with the following NULL pointer dereference: run fstests btrfs/242 at 2026-06-01 10:25:08 BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609) BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874 BTRFS info (device sdc): using crc32c checksum algorithm BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing BTRFS info (device sdc): allowing degraded mounts BTRFS info (device sdc): turning on async discard BTRFS info (device sdc): enabling free space tree Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000 CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025 pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : btrfs_trim_fs+0x34c/0xa00 [btrfs] lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs] Call trace: btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P) btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] __arm64_sys_ioctl+0xac/0x108 invoke_syscall.constprop.0+0x5c/0xd0 el0_svc_common.constprop.0+0x40/0xf0 do_el0_svc+0x24/0x40 el0_svc+0x40/0x1d0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00) ---[ end trace 0000000000000000 ]--- Also the reporter is very kind to test the following ASSERT() added to btrfs_trim_free_extents_throttle(): ASSERT(device->bdev, "devid=%llu path=%s dev_state=0x%lx\n", device->devid, btrfs_dev_name(device), device->dev_state); And it shows the following output: assertion failed: device->bdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82) Which means the device->bdev is NULL, and the dev_state is BTRFS_DEV_STATE_IN_FS_METADATA \| BTRFS_DEV_STATE_ITEM_FOUND, without BTRFS_DEV_STATE_WRITEABLE flag set. [CAUSE] The pc points to the following call chain: btrfs_trim_fs() \|- btrfs_trim_free_extents() \|- btrfs_trim_free_extents_throttle() \|- bdev_max_discard_sectors(device->bdev) So the NULL pointer dereference is caused by device->bdev being NULL. This looks impossible by a quick glance, as just before calling btrfs_trim_free_extents_throttle(), we have skipped any device that has BTRFS_DEV_STATE_MISSING flag set. However in this particular case, there is a window where the missing device is later re-scanned, causing btrfs to remove the BTRFS_DEV_STATE_MISSING flag: btrfs_control_ioctl() \|- btrfs_scan_one_device() \|- device_list_add() \|- rcu_assign_pointer(device->name, name); \| This updates the missing device's path to the new good path. \| \|- clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state) This removes the BTRFS_DEV_STATE_MISSING flag. This allows the missing device to re-appear and clear the BTRFS_DEV_STATE_MISSING flag. However the device still does not have the BTRFS_DEV_STATE_WRITEABLE flag set, nor is its bdev pointer updated. The bdev pointer remains NULL, triggering the crash later. [FIX] This is a big de-synchronization between BTRFS_DEV_STATE_MISSING and device->bdev pointer, and shows a gap in btrfs's re-appearing-device handling. The proper handling of re-appearing device will need quite some extra work, which is out of the context of this small ---truncated---
Title		btrfs: do not trim a device which is not writeable
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/02c903fc6fc7e16c5d1f22d18784f1208acf43e3 https://git.kernel.org/stable/c/1b1937eb08f51319bf71575484cde2b8c517aedc https://git.kernel.org/stable/c/210af872eafa0cf572a84cb303c0f9d2914c1226 https://git.kernel.org/stable/c/3d8fa4b828a86b33c60858e58aaab6df273ede05 https://git.kernel.org/stable/c/7a64521802997257b144e6edfb4e278dbeb972dd https://git.kernel.org/stable/c/9c894159c5b8adc84072e3af0e55b0473a69564e https://git.kernel.org/stable/c/b4af31b898a948e29861cb0bae734058f9a49d9b https://git.kernel.org/stable/c/f41ae7e6664f3c4361129728f2c4d5f3ed995251

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-06T07:13:49.700Z

Updated: 2026-08-06T07:13:49.700Z

Reserved: 2026-07-19T15:36:31.799Z

Link: CVE-2026-64593

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-06T11:45:03Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object