Linux Kernel EUVD-2026-28665

The vulnerability exists in the Linux kernel's btrfs (B-tree filesystem) implementation, specifically in the set received ioctl handler which manages subvolume UUID tracking via the BTRFS_UUID_KEY_RECEIVED_SUBVOL metadata item. The root cause is an integer overflow condition (CWE-191) in the metadata item size calculation that occurs after transaction initialization and partial metadata updates have already begun. The btrfs filesystem uses a journaling mechanism where transactions must be either fully committed or aborted; once metadata updates start, attempting to add items that exceed storage limits triggers mandatory transaction abort, which puts the entire filesystem into read-only mode as a safety mechanism. The fix involves moving overflow validation to occur before any transaction begins, allowing rejection of problematic requests without triggering filesystem-wide state transitions. The exploitation window requires holding the subvol_sem semaphore in exclusive mode, which limits concurrent exploitation vectors but does not prevent sequential attacks from a single user.