CVE-2026-46251

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix block_group_tree dirty_list corruption

When the incompat flag EXTENT_TREE_V2 is set, we unconditionally add the

block group tree to the switch_commits list before calling

switch_commit_roots, as we do for the tree root and the chunk root.

However, the block group tree uses normal root dirty tracking and in any

transaction that does an allocation and dirties a block group, the block

group root will already be linked to a list by the dirty_list field and

this use of list_add_tail() is invalid and corrupts the prev/next

members of block_group_root->dirty_list.

This is apparent on a subsequent list_del on the prev if we enable

CONFIG_DEBUG_LIST:

[32.1571] ------------[ cut here ]------------

[32.1572] list_del corruption. next->prev should beffff958890202538, but was ffff9588992bd538. (next=ffff958890201538)

[32.1575] WARNING: lib/list_debug.c:65 at 0x0, CPU#3: sync/607

[32.1583] CPU: 3 UID: 0 PID: 6

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References