CVE-2026-43118 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, system administrators, and users of Linux systems utilizing the btrfs filesystem should assess their exposure and apply patches or mitigations as necessary.

Why it matters

CVE-2026-43118 is a medium-severity vulnerability in the Linux kernel's btrfs filesystem. It affects inode size handling during log replay, potentially leading to file size inconsistencies. Linux kernel maintainers, distribution maintainers, system administrators, and users of btrfs filesystems should assess exposure and apply patches.

• Inconsistent file sizes may occur after power failure, potentially affecting data integrity.
• System administrators may need to verify and correct file sizes manually.
• Applying patches may require system downtime or reboot.
• Further investigation may be needed to determine the full scope of affected systems and files.

Technical summary

The Linux kernel vulnerability concerns the btrfs filesystem's handling of inode sizes during log replay. When logging inode existence, the generation of the logged inode item is set to 0, which can lead to incorrect inode size preservation. This issue can cause file size inconsistencies after a power failure. The fix involves ensuring that the real generation of the inode is logged if it was logged in the current transaction with the i_size previously logged.

Defensive priority

Medium priority for Linux kernel maintainers and users, especially those utilizing btrfs filesystems, to apply patches and ensure system stability.

Recommended defensive actions

• Apply patches provided by the Linux kernel maintainers to ensure system stability.
• Review and update Linux kernel versions to versions that include the fix.
• Monitor system logs for potential issues related to btrfs filesystem operations.
• Perform a thorough review of system configurations and apply necessary patches.
• Verify the integrity of affected systems and ensure data consistency.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets to ensure resolution.

Evidence notes

The CVE record and associated source references provide details on the vulnerability, including its description, affected versions, and patches. However, specific exploitation details or victim information are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.