CVE-2026-43359

MediumCVSS 5.5/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix transaction abort on set received ioctl due to item overflow

If the set received ioctl fails due to an item overflow when attempting to add the BTRFS_UUID_KEY_RECEIVED_SUBVOL we have to abort the transaction since we did some metadata updates before.

This means that if a user calls this ioctl with the same received UUID field for a lot of subvolumes, we will hit the overflow, trigger the transaction abort and turn the filesystem into RO mode. A malicious user could exploit this, and this ioctl does not even requires that a user has admin privileges (CAP_SYS_ADMIN), only that he/she owns the subvolume.

Fix this by doing an early check for item overflow before starting a transaction. This is also race safe because we are holding the subvol_sem semaphore in exclusive (write) mode.

A test case for fstests will follow soon.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-191

Affected software

VendorProductVersions
LinuxLinux>= dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < b9914db13ac15aca3b74544c0bb1a2e0dad1f174; >= dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < b19c0465e4daad5aa8f60552ea0578cf31a11b1e; >= dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < 2e57b8cac2ba0d38aac76c1ecdfd8b899e3581a5; >= dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < d11aefe654a04fc41996d254748d6a38b6b0a7be; >= dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < 41fb97353ff58fa4f31904c343fc8e3df2f7517d; >= dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < 87f2c46003fce4d739138aab4af1942b1afdadac
LinuxLinux3.12

References

Timeline

Published
May 8, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-43366.4The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via FAQ content in all versions up to, and inclCVE-2026-433605.5In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on file creation due to name hash collisioCVE-2026-433615.5In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort when snapshotting received subvolumes CurCVE-2026-433628.1In the Linux kernel, the following vulnerability has been resolved: smb: client: fix in-place encryption corruption in SMB2_write() SMB2_wCVE-2026-433635.5In the Linux kernel, the following vulnerability has been resolved: x86/apic: Disable x2apic on resume if the kernel expects so When resumCVE-2026-433645.5In the Linux kernel, the following vulnerability has been resolved: ublk: fix NULL pointer dereference in ublk_ctrl_set_size() ublk_ctrl_sCVE-2026-433658.2In the Linux kernel, the following vulnerability has been resolved: xfs: fix undersized l_iclog_roundoff values If the superblock doesn't CVE-2026-433667.8In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: check if target buffer list is still legacy on recycle CVE-2026-433675.5In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix a few more NULL pointer dereference in device cleanup I fCVE-2026-433687.8In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential overflow of shmem scatterlist length When a scCVE-2026-433695.5In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix NULL pointer dereference in device cleanup When GPU initiCVE-2026-43378.8Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of
CVE-2026-43359: Medium severity, CVSS 5.5 | Vulnix