CVE-2026-23214: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23214 is a denial-of-service vulnerability in the Linux kernel's btrfs filesystem implementation, where new transactions are incorrectly permitted on a fully read-only filesystem. When btrfs is mounted with rescue mount options (which mark the filesystem as fully read-only and prevent remounting as read-write), the kernel fails to reject new transaction attempts triggered during inode eviction at unmount time. This leads to transaction abort errors, kernel warnings, and potential system instability on corrupted filesystems. Affected kernel versions span 5.11 through 6.12.69 and 6.13 through 6.18.9, as well as 6.19 release candidates (rc1–rc6). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is an improper state check (CWE-754: Improper Check for Unusual or Exceptional Conditions) in the btrfs transaction subsystem. Btrfs normally permits new transactions even on read-only mounts to support log replay (similar to ext4/xfs), but this logic is not overridden when rescue mount options are active — a state that is fully read-only and cannot be remounted read-write. During unmount, inode eviction triggers a call chain through btrfs_evict_inode → btrfs_truncate_inode_items → btrfs_search_slot → btrfs_cow_block → btrfs_alloc_tree_block → btrfs_reserve_extent, ultimately reaching find_free_extent, which aborts with error -22 (EINVAL) and emits kernel warnings. The fix treats a filesystem with rescue mount options as being in an error state, causing the transaction subsystem to reject any new transaction initiation (Red Hat Bugzilla, Kernel Patch).

Successful exploitation results in a denial-of-service condition affecting system availability only — there is no confidentiality or integrity impact. A local attacker with low privileges can mount a specially crafted or corrupted btrfs filesystem using rescue mount options, triggering transaction abort errors (BTRFS: Transaction aborted (error -22)), kernel warnings, and potential system instability during unmount operations. The impact is limited to the local system and does not enable lateral movement or data exfiltration (Red Hat CVE, Red Hat Bugzilla).

• Logs: Kernel log entries containing BTRFS: Transaction aborted (error -22) during filesystem unmount operations.
• Logs: Kernel warnings with call traces referencing find_free_extent, btrfs_reserve_extent, btrfs_alloc_tree_block, btrfs_force_cow_block, btrfs_evict_inode in dmesg or /var/log/kern.log.
• Process: Processes mounting btrfs filesystems with rescue-related mount options (e.g., rescue=all, rescue=usebackuproot) on corrupted or fuzzed images.
• File System: Presence of heavily corrupted or fuzz-generated btrfs filesystem images being mounted by unprivileged users.

Apply the upstream kernel patches available at the stable kernel repository for affected versions (Linux kernel 5.11–6.12.69 fixed in 6.12.70, and 6.13–6.18.9 fixed in 6.18.10). Distribution-specific updates have been issued by Debian, Ubuntu, SUSE, and Oracle Linux — users should apply the latest kernel packages from their respective vendors. As an interim workaround, avoid mounting untrusted or corrupted btrfs filesystems with rescue mount options, and restrict the ability of unprivileged users to mount filesystems. Monitor kernel logs for transaction abort warnings as an indicator of attempted exploitation (Red Hat CVE, Kernel Patch).