CVE-2026-43118

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix zero size inode with non-zero size after log replay

When logging that an inode exists, as part of logging a new name or

logging new dir entries for a directory, we always set the generation of

the logged inode item to 0. This is to signal during log replay (in

overwrite_item()), that we should not set the i_size since we only logged

that an inode exists, so the i_size of the inode in the subvolume tree

must be preserved (as when we log new names or that an inode exists, we

don't log extents).

This works fine except when we have already logged an inode in full mode

or it's the first time we are logging an inode created in a past

transaction, that inode has a new i_size of 0 and then we log a new name

for the inode (due to a new hardlink or a rename), in which case we log

an i_size of 0 for the inode and a generation of 0, which causes the log

replay code to not update the inode's i_size to 0 (in overwrite_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References