CVE-2026-23465: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23465 is a data-loss vulnerability in the Linux kernel's btrfs filesystem subsystem, caused by a logging flaw when handling conflicting inodes during fsync operations. When the parent directory of a conflicting (deleted) inode is logged, new directory entries (dentries) are not recorded in the log, causing subsequent fsyncs on that directory to become no-ops. After a power failure or unexpected shutdown, newly created directory entries are missing upon log replay. Affected kernel versions span from 5.1 up to (excluding) 6.6.130, 6.7 up to (excluding) 6.12.78, 6.13 up to (excluding) 6.18.20, and 6.19 up to (excluding) 6.19.10, as well as 7.0-rc1 through rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is an incomplete logging path in the btrfs fsync implementation: when the kernel logs the parent directory of a conflicting inode (one whose name/parent matches a previously deleted, persisted inode), it marks the parent directory's inode as fully logged without actually writing its new dentries to the log tree. This means a subsequent explicit fsync on the parent directory finds it already marked as logged with no pending changes and performs no work, leaving new entries unrecorded. The vulnerability is triggered by a specific sequence: creating a file or directory with the same name as a previously synced-then-deleted directory, creating a hard link in a sibling directory, and then fsyncing that sibling directory followed by the parent. No CWE classification has been formally assigned, but the flaw is consistent with improper state tracking (incomplete logging state). The fix ensures new directory dentries are always logged when the parent directory of a no-longer-existing conflicting inode is processed (GitHub Advisory).

The primary impact is availability and data integrity: newly created directory entries can be silently lost after a power failure or unplanned system shutdown on systems using btrfs filesystems. There is no confidentiality impact, and no remote code execution or privilege escalation is possible. The data loss is limited to directory entries created after the flawed fsync sequence and is recoverable only if backups exist; it does not affect other filesystems or kernel subsystems (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability requires local access with low privileges (a regular user can trigger the condition by performing specific filesystem operations on a btrfs volume). The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

Apply the upstream kernel patches available for the affected stable branches. Fixed versions include Linux kernel 6.6.130, 6.12.78, 6.18.20, and 6.19.10. Patches are available at the stable kernel git repository (commits 1cf30c7, 56e72c8, 6f5a519, 9573a36, f556b1e). Downstream distributions including SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1) and Amazon Linux 2023 (ALAS2023-2026-1594) have issued updated packages. Systems running btrfs filesystems should prioritize applying these updates; no configuration-based workaround is available short of migrating to a different filesystem (GitHub Advisory).