VulnerabilityPublished 8 May 2026Updated 6 Nov 2026

CVE-2026-43359: Linux kernel · btrfs: fix transaction abort on set received ioctl due to item overflow

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in d11aefe654a04fc41996d254748d6a38b6b0a7be : update Linux kernel when convenient.

Data as of 6 Nov 2026, 15:49 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in d11aefe654a04fc41996d254748d6a38b6b0a7be, b9914db13ac15aca3b74544c0bb1a2e0dad1f174, b19c0465e4daad5aa8f60552ea0578cf31a11b1e +3

Exploitation evidence

Disclosed: evidence found.
CVE published 8 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < d11aefe654a04fc41996d254748d6a38b6b0a7be	Fixed in d11aefe654a04fc41996d254748d6a38b6b0a7be
LinuxLinux	Affected ≥ dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < b9914db13ac15aca3b74544c0bb1a2e0dad1f174	Fixed in b9914db13ac15aca3b74544c0bb1a2e0dad1f174
LinuxLinux	Affected ≥ dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < b19c0465e4daad5aa8f60552ea0578cf31a11b1e	Fixed in b19c0465e4daad5aa8f60552ea0578cf31a11b1e
LinuxLinux	Affected ≥ dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < 87f2c46003fce4d739138aab4af1942b1afdadac	Fixed in 87f2c46003fce4d739138aab4af1942b1afdadac
LinuxLinux	Affected ≥ dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < 41fb97353ff58fa4f31904c343fc8e3df2f7517d	Fixed in 41fb97353ff58fa4f31904c343fc8e3df2f7517d
LinuxLinux	Affected ≥ dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70, < 2e57b8cac2ba0d38aac76c1ecdfd8b899e3581a5	Fixed in 2e57b8cac2ba0d38aac76c1ecdfd8b899e3581a5

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl due to item overflow If the set received ioctl fails due to an item overflow when attempting to add the BTRFS_UUID_KEY_RECEIVED_SUBVOL we have to abort the transaction since we did some metadata updates before. This means that if a user calls this ioctl with the same received UUID field for a lot of subvolumes, we will hit the overflow, trigger the transaction abort and turn the filesystem into RO mode. A malicious user could exploit this, and this ioctl does not even requires that a user has admin privileges (CAP_SYS_ADMIN), only that he/she owns the subvolume. Fix this by doing an early check for item overflow before starting a transaction. This is also race safe because we are holding the subvol_sem semaphore in exclusive (write) mode. A test case for fstests will follow soon.

References

Community reviews

Loading reviews…