CVE-2026-46160

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix missing last_unlink_trans update when removing a directory

When removing a directory we are not updating its last_unlink_trans field,

which can result in incorrect fsync behaviour in case some one fsyncs the

directory after it was removed because it's holding a file descriptor on

it.

Example scenario:

mkdir /mnt/dir1

mkdir /mnt/dir1/dir2

mkdir /mnt/dir3

sync -f /mnt

# Do some change to the directory and fsync it.

chmod 700 /mnt/dir1

xfs_io -c fsync /mnt/dir1

# Move dir2 out of dir1 so that dir1 becomes empty.

mv /mnt/dir1/dir2 /mnt/dir3/

open fd on /mnt/dir1

call rmdir(2) on path "/mnt/dir1"

fsync fd

<trigger power failure>

When attempting to mount the filesystem, the log replay will fail with

an -EIO error and dmesg/syslog has the following:

[445771.626482] BTRFS info (device dm-0): first mount of filesystem 0368bbea-6c5e-44b5-b409-09abe496e650

[445771

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References