SB20260529139 - Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel btrfs

Description

This security bulletin contains information about 1 vulnerability.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-46159)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a time-of-check time-of-use race in btrfs_ioctl_space_info() when processing a space information ioctl request while block groups are concurrently removed. A local user can trigger the ioctl and race concurrent block group removal to disclose sensitive information.

The issue can result in copying uninitialized kmalloc heap bytes to userspace.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4fdc6ee0802121d9cd96b8d085e589f51e5a4ec3
• https://git.kernel.org/stable/c/5d12e0ab009ade48c1bff9324fd9bea2c773d088
• https://git.kernel.org/stable/c/973e57c726c1f8e77259d1c8e519519f1e9aea77
• https://git.kernel.org/stable/c/d09d67d5de577cedae3de9497dff217e0ac8b641
• https://git.kernel.org/stable/c/f5ee467b56764964027c361641f64953fc0f8f9a