CVE-2026-64593: Linux kernel · btrfs: do not trim a device which is not writeable
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f41ae7e6664f3c4361129728f2c4d5f3ed995251 : patch Linux kernel soon.
Data as of 6 Nov 2026, 18:18 UTC
Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in f41ae7e6664f3c4361129728f2c4d5f3ed995251, b4af31b898a948e29861cb0bae734058f9a49d9b, 210af872eafa0cf572a84cb303c0f9d2914c1226 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix for this vulnerability has been implemented in multiple Linux kernel commits as indicated by the fixedVersions list. Users should update their Linux kernel to a version that includes these fixes to prevent the NULL pointer dereference. No additional mitigation steps are indicated or required beyond applying the official fix.
Description
CVE-2026-64593 is a vulnerability in the Linux kernel's btrfs filesystem where a NULL pointer dereference can occur during a trim operation on a device that is not writable. This happens due to a desynchronization between device state flags and the device's block device pointer, leading to a crash when the system attempts to trim a device whose bdev pointer is NULL. The issue arises when a previously missing device reappears but does not have its writable flag set nor its bdev pointer updated.
References
- git.kernel.org/stable/c/f41ae7e6664f3c4361129728f2c4d5f3ed995251 (opens in a new tab)
- git.kernel.org/stable/c/210af872eafa0cf572a84cb303c0f9d2914c1226 (opens in a new tab)
- git.kernel.org/stable/c/3d8fa4b828a86b33c60858e58aaab6df273ede05 (opens in a new tab)
- git.kernel.org/stable/c/9c894159c5b8adc84072e3af0e55b0473a69564e (opens in a new tab)
- git.kernel.org/stable/c/02c903fc6fc7e16c5d1f22d18784f1208acf43e3 (opens in a new tab)
- git.kernel.org/stable/c/7a64521802997257b144e6edfb4e278dbeb972dd (opens in a new tab)
- git.kernel.org/stable/c/b4af31b898a948e29861cb0bae734058f9a49d9b (opens in a new tab)
- git.kernel.org/stable/c/1b1937eb08f51319bf71575484cde2b8c517aedc (opens in a new tab)