Linux Kernel btrfs CVE-2026-43308

Local authenticated access to a Linux system with btrfs filesystem mounted and active. The attacker must trigger a specific edge case in btrfs delayed reference processing where run_one_delayed_ref() receives an unexpected delayed reference type, which may require either inducing filesystem corruption, exploiting a race condition in concurrent btrfs operations, or discovering a specific sequence of filesystem manipulations (file creation, deletion, snapshot operations, or extent modifications). The vulnerability is NOT exploitable remotely. Attack complexity is rated low (AC:L) but practical exploitation likely requires deep knowledge of btrfs internals and the specific conditions that generate unexpected reference types. Default btrfs configurations on most distributions are vulnerable if the kernel version predates the patch. Limiting factors include the requirement for local authenticated access and the need to trigger an uncommon error condition in the delayed reference subsystem.

Real-world risk is LOW despite the CVSS 5.5 (Medium) score and high availability impact. The CVSS vector AV:L/AC:L/PR:L indicates local access with low attack complexity but requires an authenticated local user with low privileges. The EPSS score of 0.02% (5th percentile) suggests extremely low probability of exploitation in the wild. No CISA KEV listing, no public proof-of-concept, and no evidence of active exploitation. The vulnerability requires triggering a specific edge case in btrfs delayed reference processing that results in an unexpected reference type - this suggests either filesystem corruption, a race condition, or a specific sequence of filesystem operations that is unlikely to occur naturally. The impact is limited to denial of service (system crash) with no confidentiality or integrity impact, and the attacker must already have local authenticated access. Priority should be moderate for systems with local untrusted users or where btrfs is used for critical filesystems, but low for single-user systems or environments without btrfs. The patch is straightforward error handling improvement with minimal risk of regression.

A local authenticated attacker with low privileges on a Linux system using btrfs filesystem crafts a specific sequence of filesystem operations or exploits a race condition in extent tree operations that causes the btrfs delayed reference subsystem to generate an unexpected reference type. When run_one_delayed_ref() processes this malformed reference, it triggers the BUG() condition, immediately crashing the kernel and causing a complete system denial of service requiring manual reboot.