CVE-2026-23181: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23181 is a vulnerability in the Linux kernel's btrfs filesystem subsystem involving a race condition between block size changes and read cache page allocation. When a user executes the BLKBSZSET ioctl command to change a block device's block size (e.g., from 0x1000 to 0x4000), the change affects mapping->flags and the result of mapping_min_folio_order(). If a folio is allocated before the block size change but used after, a mismatch in folio order can trigger a VM_BUG_ON_FOLIO assertion or a null pointer dereference in create_empty_buffers() due to buffer head allocation failure. The vulnerability was published on February 14, 2026, and is estimated as Medium severity with an EPSS score of 0.00018 (Feedly).

The root cause is a synchronization gap (CWE-362: Race Condition) between the BLKBSZSET ioctl command and the read cache page allocation path in the btrfs filesystem. When do_read_cache_folio() allocates a folio with order 0 (corresponding to block size 0x1000), and subsequently BLKBSZSET increases the block size to 0x4000 — causing mapping_min_folio_order() to return 2 — the already-allocated folio's order no longer satisfies the mapping's minimum folio order requirement. This leads to two failure modes: (1) a VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping)) assertion failure, and (2) a null pointer dereference in create_empty_buffers() when buffer head allocation fails, as reported by syzbot. The fix requires establishing proper synchronization between the BLKBSZSET command and the read cache page path based on the inode (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation of this vulnerability can cause a kernel crash (denial of service) on systems using the btrfs filesystem. The null pointer dereference in create_empty_buffers() and the VM_BUG_ON_FOLIO assertion can both result in a kernel panic, leading to system unavailability. There is no evidence of confidentiality or integrity impact beyond the availability disruption caused by the crash.

This vulnerability requires local access to trigger, as it involves executing the BLKBSZSET ioctl command on a block device during a btrfs mount operation. No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is very low at 0.00018, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

The Linux kernel maintainers have addressed this vulnerability by synchronizing the BLKBSZSET command and read cache page allocation based on the inode. Patches are available in the stable kernel tree at the referenced commits. Users should update to a patched Linux kernel version that includes the fix for btrfs disk super sync and block size setting (Kernel Patch 1, Kernel Patch 2). As a workaround, avoiding the use of BLKBSZSET on block devices used by btrfs filesystems can mitigate the risk until a patched kernel is deployed.