CVE-2026-23141: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23141 is a Linux kernel vulnerability in the btrfs send subsystem where the range_is_hole_in_parent() function fails to check for inline extents before accessing the disk_bytenr field of a file extent item. This missing validation can result in invalid memory access or unintended access to metadata from adjacent items in the B-tree leaf. The vulnerability was published on February 14, 2026, and affects Linux kernel versions 4.11 through 6.6.121, 6.7 through 6.12.66, 6.13 through 6.18.6, and 6.19-rc1 through rc5. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper input validation (CWE-20) in the btrfs send code path: for inline extents, the extent data begins at the offset of the disk_bytenr field rather than being a pointer to on-disk data, so reading disk_bytenr without first checking the extent type reads raw inline file data or, if the inline data is fewer than 8 bytes and the item is the first in the leaf, can trigger an out-of-bounds memory read into adjacent kernel metadata. Exploitation requires local access with low privileges and the ability to trigger a btrfs send operation on a filesystem containing inline extents. Four upstream fix commits were applied to stable branches: 08b096c, 39f83f1, db00636, and f2dc6ab (Kernel Patches, Feedly).

Successful exploitation can cause a kernel crash or system hang, resulting in a denial-of-service condition. Because the vulnerability affects kernel memory access, there is also a theoretical risk of reading sensitive kernel metadata from adjacent B-tree items, though no confidentiality or integrity impact has been confirmed. The availability impact is rated High, while confidentiality and integrity impacts are rated None in the CVSS assessment (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access with low privileges and the ability to initiate a btrfs send operation on a filesystem with inline extents.

Update the Linux kernel to a patched stable release: 6.6.122 or later (for the 6.6.x branch), 6.12.67 or later (for the 6.12.x branch), or 6.18.7 or later (for the 6.13–6.18.x branch) (Feedly, Kernel Patches). Vendor-specific updates are available from Oracle Linux, SUSE, Debian, Ubuntu, and Amazon Linux 2023. As a temporary workaround where patching is not immediately possible, restrict local user access to systems with btrfs filesystems and disable btrfs send operations if they are not operationally required.

Multiple Linux distribution vendors — including Oracle, SUSE, Debian, Ubuntu, and Amazon Linux — have issued kernel update advisories addressing this CVE, indicating broad downstream awareness and patching activity (Oracle Advisory, SUSE Advisory, Debian Advisory). No notable independent researcher commentary or significant social media discussion specific to this CVE has been observed.