CVE-2026-43360

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix transaction abort on file creation due to name hash collision

If we attempt to create several files with names that result in the same

hash, we have to pack them in same dir item and that has a limit inherent

to the leaf size. However if we reach that limit, we trigger a transaction

abort and turns the filesystem into RO mode. This allows for a malicious

user to disrupt a system, without the need to have administration

privileges/capabilities.

Reproducer:

$ cat exploit-hash-collisions.sh

#!/bin/bash

DEV=/dev/sdi

MNT=/mnt/sdi

# Use smallest node size to make the test faster and require fewer file

# names that result in hash collision.

mkfs.btrfs -f --nodesize 4K $DEV

mount $DEV $MNT

# List of names that result in the same crc32c hash for btrfs.

declare -a names=(

'foobar'

'%a8tYkxfGMLWRGr55QSeQc4PBNH9PCLIvR6jZnkDtUUru1t@RouaUe_L:@xGkbO3nCwvLNYeK9vhE628gss:T$yZjZ5l-Nbd6CbC$M=hq

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References