PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45974 Linux CVE debrief

A vulnerability in the Linux kernel's Btrfs filesystem could allow invalid memory access during quota enablement operations. The flaw occurs in btrfs_quota_enable() when btrfs_search_slot_for_read() returns 1, indicating no matching key was found and the end of the tree has been reached. In this case, the code path fails to properly break from the loop, leading to subsequent access of an invalid path structure. This represents a logic error where the return value indicating search exhaustion is not handled correctly, potentially resulting in out-of-bounds or use-after-free access patterns depending on the state of the path structure. The vulnerability is confined to the quota enablement code path and requires administrative privileges to trigger. Multiple stable kernel branches have received patches to address this issue.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux system administrators running Btrfs filesystems with quota functionality enabled; security teams tracking kernel-level filesystem vulnerabilities; organizations with infrastructure dependent on Btrfs for storage management

Technical summary

The vulnerability exists in fs/btrfs/qgroup.c in the btrfs_quota_enable() function. When iterating through the filesystem tree to locate reference keys, btrfs_search_slot_for_read() may return 1 to indicate that no key greater than or equal to the search key exists—effectively signaling end-of-tree. The existing code fails to check for this return value and continues processing, resulting in access to an invalid path structure. The fix adds proper handling to break from the loop when this condition occurs. The issue affects multiple stable kernel branches and has been patched across 5.4, 5.10, 5.15, 6.1, 6.6, 6.10, and 6.11-rc series.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the Btrfs quota fix for CVE-2026-45974
  • Verify running kernel version is at or above patched versions: 5.4.284, 5.10.225, 5.15.166, 6.1.107, 6.6.48, 6.10.7, or 6.11-rc4
  • Monitor distribution security advisories for kernel package availability
  • Review systems with Btrfs quotas enabled for any anomalous behavior during quota operations
  • Consider disabling Btrfs quotas temporarily on critical systems if patching is delayed and quota functionality is not required

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Patch commits identified in kernel.org stable repositories. No CVSS score or severity rating has been assigned by NVD as of the modified date.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45974 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45974

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45974 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45974

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/023545e272f369d487e6a986c1e321c6e04be1da

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0761447f6f51e1c7997960d8e6559337deed6729

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1ee1d006c9fe4d6be5527ab1c84216b80cccbe40

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b2bd557b75b760e4b9d209112bda19314bd64558

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b5b8ade9da452086e78f5d519b90d3769e354853

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d7cf2314dd5e8661c05d076cd627eea9a7f76616

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ecb7c2484cfc83a93658907580035a8adf1e0a92

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.