CVE-2026-43299

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()

[BUG]

There is a bug report that when btrfs hits ENOSPC error in a critical

path, btrfs flips RO (this part is expected, although the ENOSPC bug

still needs to be addressed).

The problem is after the RO flip, if there is a read repair pending, we

can hit the ASSERT() inside btrfs_repair_io_failure() like the following:

BTRFS info (device vdc): relocating block group 30408704 flags metadata|raid1

------------[ cut here ]------------

BTRFS: Transaction aborted (error -28)

WARNING: fs/btrfs/extent-tree.c:3235 at __btrfs_free_extent.isra.0+0x453/0xfd0, CPU#1: btrfs/383844

Modules linked in: kvm_intel kvm irqbypass

[...]

---[ end trace 0000000000000000 ]---

BTRFS info (device vdc state EA): 2 enospc errors during balance

BTRFS info (device vdc state EA): balance: ended with status: -30

BTRFS error (device vdc state EA): pare

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References