PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45974 Linux CVE debrief

A vulnerability in the Linux kernel's Btrfs filesystem could allow invalid memory access during quota enablement operations. The flaw occurs in btrfs_quota_enable() when btrfs_search_slot_for_read() returns 1, indicating no matching key was found and the end of the tree has been reached. In this case, the code path fails to properly break from the loop, leading to subsequent access of an invalid path structure. This represents a logic error where the return value indicating search exhaustion is not handled correctly, potentially resulting in out-of-bounds or use-after-free access patterns depending on the state of the path structure. The vulnerability is confined to the quota enablement code path and requires administrative privileges to trigger. Multiple stable kernel branches have received patches to address this issue.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running Btrfs filesystems with quota functionality enabled; security teams tracking kernel-level filesystem vulnerabilities; organizations with infrastructure dependent on Btrfs for storage management

Technical summary

The vulnerability exists in fs/btrfs/qgroup.c in the btrfs_quota_enable() function. When iterating through the filesystem tree to locate reference keys, btrfs_search_slot_for_read() may return 1 to indicate that no key greater than or equal to the search key exists—effectively signaling end-of-tree. The existing code fails to check for this return value and continues processing, resulting in access to an invalid path structure. The fix adds proper handling to break from the loop when this condition occurs. The issue affects multiple stable kernel branches and has been patched across 5.4, 5.10, 5.15, 6.1, 6.6, 6.10, and 6.11-rc series.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the Btrfs quota fix for CVE-2026-45974
  • Verify running kernel version is at or above patched versions: 5.4.284, 5.10.225, 5.15.166, 6.1.107, 6.6.48, 6.10.7, or 6.11-rc4
  • Monitor distribution security advisories for kernel package availability
  • Review systems with Btrfs quotas enabled for any anomalous behavior during quota operations
  • Consider disabling Btrfs quotas temporarily on critical systems if patching is delayed and quota functionality is not required

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Patch commits identified in kernel.org stable repositories. No CVSS score or severity rating has been assigned by NVD as of the modified date.

Official resources

2026-05-27