Improper input validation in Linux kernel - CVE-2026-43046
Published: May 2, 2026
Vulnerability identifier: #VU128874
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-43046
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the btrfs root item handling and relocation recovery code when mounting a btrfs filesystem containing corrupted metadata. A local user can mount a crafted filesystem image to cause a denial of service.
The issue is triggered during relocation recovery at mount time when a root item contains a non-zero drop_progress.objectid together with a zero drop_level.
How to mitigate CVE-2026-43046
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/295f8075d00442d71dc9ccae421ace1c0d2d9224
- https://git.kernel.org/stable/c/53ceedd1eb6280ca8359664e0226983eded2ed73
- https://git.kernel.org/stable/c/850de3d87f4720b71ccdcd44f4aa57e46b53a3f3
- https://git.kernel.org/stable/c/ac68a9a8e481ab1becaed29d6d23087dac3de15d
- https://git.kernel.org/stable/c/b17b79ff896305fd74980a5f72afec370ee88ca4
- https://git.kernel.org/stable/c/bedaf7d0b9d793e116f16b4d9a7dbc94bcc80443
- https://git.kernel.org/stable/c/de585ee18dd5601745f65a60fef7b7ceebd78c83