EUVD-2026-108753
GHSA-cf5f-cwf6-82gc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal access to mounted btrfs filesystem
-
DeliverySet two crc32c-colliding xattrs on an owned file
-
ExploitReplace one xattr value with a different size
-
ExecutionDelete+insert shifts leaf data, leaving btrfs_dir_item uninitialized
-
Persistlistxattr reads out-of-range, tree checker aborts transaction
-
ImpactXattr data loss and filesystem instability
Vulnerability Assessment
| Exploitation Conditions | Requires a mounted btrfs filesystem (not ext4/xfs) and a local user able to write extended attributes to a file on it (e.g. user.* xattrs on an owned file). The specific trigger is: create two xattrs whose names produce the same crc32c hash so they are packed into a single btrfs_dir_item, then replace the value of one of them (via the setxattr(2) family) with a value of a different size, which leaves the newly inserted btrfs_dir_item with uninitialized name/name-length/key/flags/transid fields. Limiting factors: exploitation is local only (no network vector), is confined to btrfs-formatted volumes, depends on engineering a crc32c name collision, and yields metadata corruption, a tree-checker-detected out-of-range read, and transaction abort rather than code execution. |
| Impact | The input CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) materially overstates real-world risk and contradicts the vulnerability mechanism: this is a btrfs filesystem bug triggered via the local setxattr(2) syscall family, with no network-reachable component - there is no network vector or remote unauthenticated path, so the AV:N/PR:N vector should be treated as erroneous and verified against the kernel advisory. Supporting signals point to low urgency in practice: EPSS is 0.21% (10th percentile), there is no CISA KEV listing, and the effect is metadata corruption, a tree-checker-caught out-of-range read in btrfs_listxattr, and a transaction abort (availability/integrity loss), not remote code execution. The 'Information Disclosure' tag has a plausible basis - the dmesg trace shows read_extent_buffer accessing an extent buffer out of range during listxattr, which can expose adjacent uninitialized leaf contents - but the dominant observed impact is filesystem corruption and forced read-only/abort. The vuln.today Decision label is act_now and a vendor patch is available, so this should be scheduled for prompt kernel updating on btrfs systems; however, the combination of local-only access, btrfs-specific triggering conditions, and low EPSS indicates this is a correctness/robustness fix rather than a widespread remote-exploitation emergency, despite the 9.8 figure. Net: prioritize patching on btrfs deployments, but the headline 9.8 is not a reliable indicator of exposure here. |
| Exploit ScenarioDerived | A local user with a file on a mounted btrfs filesystem sets two extended attributes whose names collide under crc32c (so the kernel packs them into one btrfs_dir_item), then uses setfattr to replace one value with a differently-sized value, producing a partially-uninitialized btrfs_dir_item. A subsequent listxattr reads out of range and the kernel aborts the transaction, losing an xattr and destabilizing the filesystem. A public reproducer script is embedded in the advisory demonstrating this corruption; it is not verified as a working privilege-escalation or code-execution exploit, and exploitation is local-only per the described trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
A metadata-corruption bug in the Linux kernel's btrfs extended-attribute handling lets a local user who can call setxattr(2) on a file stored on a btrfs volume leave a newly inserted btrfs_dir_item partially initialized, which the tree checker later flags at extent-buffer writeback and which ultimately aborts the transaction. Two conditions must line up: two xattr names must share a crc32c hash so they are packed into one btrfs_dir_item, and the value of one of them must be replaced with a value of a different size. The published CVSS 9.8 (AV:N/AC:L/PR:N) does not reflect the mechanism - there is no network-reachable path; the realistic vector is local, low-privileged (AV:L/AC:L/PR:L, C:L/I:L/A:H), so exposure is confined to hosts running btrfs with untrusted local writers. EPSS is low at 0.21% (10th percentile), the issue is not in CISA KEV, and a reproducer script from the fix commit is public; it is not verified as working exploit code. The prioritisation label is act_now and vendor fixes are available.
RemediationAI
Apply the vendor-released Linux kernel updates that carry the fix: 6.6.160, 6.12.113, 6.18.57, 7.2.11 or 7.3, or pick up the individual stable commits 7a53bb4668b319fc6c8a3ce2c21635125c7d2712, 5877d7138cc4359d26fd7b010eedfd1b3162348f, a97114b9b00ed3d05156f3b2ddbf797296260389, c1803697a60f22743aa28ad522f805e92d45e3f0 and 858bee1c77857aabcc2327cd32dd8266332de332 from https://git.kernel.org/stable/c/7a53bb4668b319fc6c8a3ce2c21635125c7d2712 (see also https://nvd.nist.gov/vuln/detail/CVE-2026-98959). The prioritisation label is act_now, so patch btrfs-enabled hosts promptly rather than treating this as a background item. No configuration-level workaround is documented in the available sources - updating is the complete fix - so interim exposure reduction means limiting untrusted local interactive or service accounts that can set user.* xattrs on btrfs mounts, and watching dmesg for 'access to eb bytenr ... out of range', report_eb_range() warnings or btrfs tree-checker/transaction-abort messages, which indicate a volume has already been corrupted and should be scrubbed and restored from backup. Note the real attack surface is local only, so internet-facing perimeter controls have no bearing on this CVE.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
btrfs stores directory entries and small extended attributes in btrfs_dir_item structures inside a leaf. Multiple xattrs can be packed into one item, and the lookup key is a crc32c hash of the attribute name, so two distinct names can collide and land in the same packed item. btrfs_setxattr() handles a replace by deleting the matched btrfs_dir_item and inserting a new one; because deletion and insertion shift data within the leaf, and because the new value may have a different length, the freshly placed structure ends up in a leaf region that was never initialised. The code copies only the value payload and sets the value length, leaving the name, name length, key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and transaction ID unset. The corrupted item is then read back out of range - the advisory's dmesg shows 'access to eb bytenr ... out of range' and a WARN at report_eb_range() from btrfs_listxattr() - and the tree checker detects the corruption during extent-buffer writeback, aborting the transaction. No CWE was supplied, but the root cause is a use of uninitialised / improperly initialised in-memory metadata combined with a size-change on an in-place leaf update. Affected builds are Linux kernels with the btrfs module; the reference CPE strings are cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, and the two commits at the base of the affected range are 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 and related branches listed by EUVD. Only btrfs volumes are affected; ext4 and XFS are not.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Triggered via local setxattr on a btrfs file by an unprivileged file owner (AV:L, PR:L, UI:N); causes out-of-range read (C:L), metadata corruption (I:L) and transaction abort/data loss (A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix xattr replace when multiple xattrs are packed in the same item
If we have a btrfs_dir_item item that packs multiple xattrs and then we replace the value of one of them (with the setxattr(2) family of syscalls) with another value of a different size, we end up not having a fully initialized btrfs_dir_item, resulting in a corruption that the tree checker will detect at extent buffer writeback time.
This is because in btrfs_setxattr() when we find a btrfs_dir_item with multiple xattrs (due to the crc32c hash of their name being the same) we delete one of the xattr items (btrfs_dir_item) and then insert a new one, but the deletion and insertion results in shifting existing data in the leaf and therefore when the new value of a xattr has a different size, the new btrfs_dir_item is placed in a leaf section that was not initialized and we only copy the value's data and set the value's length in the new btrfs_dir_item, without setting the name, the name's length, the key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and transaction ID.
The following script reproduces the issue:
$ cat test.sh #!/bin/bash
DEV=/dev/sdi MNT=/mnt/sdi
mkfs.btrfs -f $DEV mount $DEV $MNT
touch $MNT/testfile
Add two xattrs that, on btrfs, have the same hash (crc32c) for their
name and therefore are packed into the same btrfs_dir_item.
setfattr -n user.foobar -v 123 $MNT/testfile setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile
Verify the xattrs are present.
echo "xattrs before:" getfattr --absolute-names --dump $MNT/testfile
Now replace the value of the foobar xattr with a significantly larger
value.
setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile
Check the xattrs have the expected values.
echo "xattrs after:" getfattr --absolute-names --dump $MNT/testfile
umount $MNT
Running it:
$ ./test.sh (...) xattrs before:
file: /mnt/sdi/testfile
user.WvG1c1Td="qwerty" user.foobar="123"
xattrs after:
file: /mnt/sdi/testfile
user.WvG1c1Td="qwerty"
So the "user.foobar" xattr is missing and there was a transaction abort when unmounting the fs with the following traces in dmesg:
$ dmesg [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964 [869800.159293] ------------[ cut here ]------------ [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179 [869800.168961] Modules linked in: btrfs dm_thin_pool (...) [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G W 7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full) [869800.193726] Tainted: [W]=WARN [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs] [869800.198985] Code: 48 8b 7b 18 (...) [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246 [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000 [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0 [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069 [869800.229097] FS: 00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000 [869800.231137] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0 [869800.233783] Call Trace: [869800.234330] <TASK> [869800.234791] read_extent_buffer+0x4d/0x100 [btrfs] [869800.235898] btrfs_listxattr+0x199/0x240 [btrfs] [869800.236912] vfs_listxattr+0x51/0 ---truncated---
Executive ViewAI
A metadata-corruption flaw in Linux kernel btrfs extended-attribute handling requires local access to hosts using btrfs with untrusted writers. While the CVSS 9.8 is misleading, the bug's conditions make it relatively difficult to trigger, but the potential for data corruption and system crashes warrants attention.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB