CVE-2026-43046: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43046 is a reachable assertion vulnerability in the Linux kernel's btrfs filesystem subsystem, specifically in the handling of root items with an invalid drop_progress/drop_level combination. When a btrfs root item on disk contains a non-zero drop_progress.objectid paired with a zero drop_level, the kernel's relocation recovery code triggers a BUG_ON(level == 0) assertion, causing a kernel panic (denial of service). The vulnerability affects Linux kernel versions from 2.6.29 through multiple stable branches, with fixed versions including 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, and 6.19.12. It was published on May 1, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is improper validation of consistency within input (CWE-1288) combined with a reachable assertion (CWE-617): the kernel enforces the invariant that drop_level > 0 when drop_progress.objectid != 0 only when writing root items, but not when reading them back from disk. An attacker or corrupted disk can supply a root item where drop_progress.objectid is non-zero and drop_level is zero — a state that violates the internal contract of btrfs_drop_snapshot(). When the filesystem is mounted and relocation recovery runs, merge_reloc_root() (at relocation.c:1545) or btrfs_drop_snapshot() reads the invalid drop_level and hits BUG_ON(level == 0), producing an "invalid opcode" kernel oops. The bug was discovered using a dynamic metadata fuzzing tool against kernel 7.0.0-rc2-next-20260310 and is fixed by adding a tree-checker validation that rejects malformed root items with -EUCLEAN before they reach the vulnerable code paths (Github Advisory, Red Hat Bugzilla).

Successful exploitation results in a kernel panic (BUG_ON assertion failure), causing an immediate system crash and denial of service. The affected system becomes unable to mount the crafted btrfs filesystem, and the kernel oops renders the filesystem inaccessible. There is no confidentiality or integrity impact — the vulnerability is limited to availability, affecting any system that attempts to mount a btrfs filesystem containing the malformed metadata (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability requires local access and the ability to supply or modify btrfs on-disk metadata (e.g., by mounting a crafted filesystem image or having write access to a block device). The EPSS score is approximately 0.024% (3rd percentile), indicating a very low probability of near-term exploitation. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Prepare a malicious btrfs image: Using a btrfs metadata manipulation tool or a fuzzer, craft a btrfs filesystem image where a root item has drop_progress.objectid set to a non-zero value and drop_level set to zero, violating the internal kernel invariant.
2. Transfer the image to the target: Copy the crafted filesystem image to the target system via any available means (e.g., USB drive, network share, or direct block device write if access is available).
3. Trigger mount: Execute a mount command on the target system pointing to the crafted btrfs image (e.g., mount -t btrfs /dev/sdX /mnt). This requires local access and sufficient privileges (typically root or CAP_SYS_ADMIN).
4. Relocation recovery triggers the bug: During mount, btrfs_recover_relocation() → merge_reloc_roots() → merge_reloc_root() processes the malformed root item, reads drop_level == 0, and hits BUG_ON(level == 0) at relocation.c:1545, causing an immediate kernel panic and system crash (Github Advisory, Red Hat Bugzilla).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing kernel BUG at fs/btrfs/relocation.c:1545, Oops: invalid opcode, or BUG_ON(level == 0) during a btrfs mount operation.
• Logs: Stack traces referencing merge_reloc_root, merge_reloc_roots, btrfs_recover_relocation, btrfs_start_pre_rw_mount, or open_ctree in the kernel oops output.
• Logs: System crash/reboot events correlated with btrfs mount attempts, particularly involving filesystems with interrupted relocation operations.
• File System: Presence of a btrfs filesystem image or block device with a root item where drop_progress.objectid != 0 and drop_level == 0, detectable via btrfs check or btrfs-debug-tree output showing inconsistent root item fields.

Update the Linux kernel to a patched version: 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, or 6.19.12 (or later). The fix adds a tree-checker validation in the btrfs code that rejects root items with drop_progress.objectid != 0 and drop_level == 0 with a -EUCLEAN error at read time, preventing the BUG_ON from being reached. As a precautionary measure, run btrfs check on any btrfs filesystems that may have been exposed to metadata corruption before mounting them on unpatched kernels. Amazon Linux 2 users can refer to ALAS2KERNEL-5.15-2026-102 for the relevant update (Github Advisory, Red Hat Bugzilla).

Red Hat tracked the issue via Bugzilla (Bug 2464390) and assigned it a medium severity rating. The upstream kernel advisory was published via the linux-cve-announce mailing list. No significant public researcher commentary or social media discussion has been identified beyond standard CVE tracking and vendor advisory channels (Red Hat Bugzilla).