Linux Kernel CVE-2026-43299

Requires btrfs filesystem configured with RAID levels that store multiple data/metadata copies (RAID1, RAID5, RAID6, or DUP profiles). Filesystem must encounter ENOSPC error specifically during critical transaction paths (extent tree operations, balance, relocation) that trigger transaction abort and RO flip. A read operation with checksum verification failure must be pending in the btrfs-endio workqueue at the moment of RO transition. Does NOT require remote access - exploitation is local with PR:L indicating low-privileged local user can trigger via normal filesystem operations under resource pressure. No special authentication beyond local user access required. Not exploitable against default single-disk btrfs configurations without RAID/mirroring, as read-repair mechanism only activates with alternate data copies available. User interaction not required (UI:N). The race condition between RO flip and queued repair operation limits reliable exploitation outside controlled test environments, explaining the low EPSS score despite low attack complexity rating.

Real-world risk is moderate for systems using btrfs with RAID configurations and experiencing metadata space pressure. CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local attack vector requiring low privileges with high availability impact. Attack complexity is low, suggesting reproducibility once conditions are met. EPSS score of 0.02% (5th percentile) indicates very low probability of mass exploitation, consistent with the specific preconditions required (btrfs with RAID, pending read repair, critical ENOSPC error). Not listed in CISA KEV, and no public exploit code identified at time of analysis. SSVC framework assessment: exploitation requires local access to a system already experiencing filesystem errors, automatable only in specific test scenarios (btrfs/124 test case mentioned), technical impact is availability loss through kernel panic. The CVSS high availability score aligns with the kernel crash outcome, but real-world prioritization should be lower than the numeric score suggests - this is primarily a stability issue affecting systems already under resource stress rather than a remotely exploitable security vulnerability. Organizations running btrfs in production with tight metadata reservations should prioritize the patch; systems with ample metadata space or using other filesystems can defer.

An authenticated local user on a system using btrfs with RAID1 metadata configuration triggers intensive file operations that consume available metadata space. The filesystem encounters an ENOSPC error during a critical transaction commit (such as balance or relocation operations), causing btrfs to abort the transaction and transition to read-only mode. Simultaneously, a pending read operation detects corruption via checksum mismatch and queues a repair operation in the btrfs-endio workqueue. When the repair worker thread executes btrfs_repair_io_failure() after the RO transition completes, the ASSERT() fires, triggering a kernel BUG that crashes the system with an invalid opcode exception, causing immediate denial of service.