{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-43361 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-43361 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-43361 and fix it if it is affected.\n\nWhat it is: CVE-2026-43361 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-43361 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-43361/ (Markdown: https://insights.sbomify.com/CVE-2026-43361/index.md)","id":"CVE-2026-43361","markdown":"https://insights.sbomify.com/CVE-2026-43361/index.md","name":"CVE-2026-43361","record":{"aliases":["BELL-CVE-2026-43361","DEBIAN-CVE-2026-43361","GHSA-v9r8-chwp-vmrm","ROOT-OS-DEBIAN-11-CVE-2026-43361","ROOT-OS-UBUNTU-2204-CVE-2026-43361","ROOT-OS-UBUNTU-2404-CVE-2026-43361","UBUNTU-CVE-2026-43361"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel btrfs","requires_auth":"low_privilege","summary":"A local user can trigger a transaction abort in the btrfs filesystem by repeatedly snapshotting received subvolumes, forcing the filesystem into read-only mode.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix transaction abort when snapshotting received subvolumes\n\nCurrently a user can trigger a transaction abort by snapshotting a\npreviously received snapshot a bunch of times until we reach a\nBTRFS_UUID_KEY_RECEIVED_SUBVOL item overflow (the maximum item size we\ncan store in a leaf). This is very likely not common in practice, but\nif it happens, it turns the filesystem into RO mode. The snapshot, send\nand set_received_subvol and subvol_setflags (used by receive) don't\nrequire CAP_SYS_ADMIN, just inode_owner_or_capable(). A malicious user\ncould use this to turn a filesystem into RO mode and disrupt a system.\n\nReproducer script:\n\n  $ cat test.sh\n  #!/bin/bash\n\n  DEV=/dev/sdi\n  MNT=/mnt/sdi\n\n  # Use smallest node size to make the test faster.\n  mkfs.btrfs -f --nodesize 4K $DEV\n  mount $DEV $MNT\n\n  # Create a subvolume and set it to RO so that it can be used for send.\n  btrfs subvolume create $MNT/sv\n  touch $MNT/sv/foo\n  btrfs property set $MNT/sv ro true\n\n  # Send and receive the subvolume into snaps/sv.\n  mkdir $MNT/snaps\n  btrfs send $MNT/sv | btrfs receive $MNT/snaps\n\n  # Now snapshot the received subvolume, which has a received_uuid, a\n  # lot of times to trigger the leaf overflow.\n  total=500\n  for ((i = 1; i \u003c= $total; i++)); do\n      echo -ne \"\\rCreating snapshot $i/$total\"\n      btrfs subvolume snapshot -r $MNT/snaps/sv $MNT/snaps/sv_$i \u003e /dev/null\n  done\n  echo\n\n  umount $MNT\n\nWhen running the test:\n\n  $ ./test.sh\n  (...)\n  Create subvolume '/mnt/sdi/sv'\n  At subvol /mnt/sdi/sv\n  At subvol sv\n  Creating snapshot 496/500ERROR: Could not create subvolume: Value too large for defined data type\n  Creating snapshot 497/500ERROR: Could not create subvolume: Read-only file system\n  Creating snapshot 498/500ERROR: Could not create subvolume: Read-only file system\n  Creating snapshot 499/500ERROR: Could not create subvolume: Read-only file system\n  Creating snapshot 500/500ERROR: Could not create subvolume: Read-only file system\n\nAnd in dmesg/syslog:\n\n  $ dmesg\n  (...)\n  [251067.627338] BTRFS warning (device sdi): insert uuid item failed -75 (0x4628b21c4ac8d898, 0x2598bee2b1515c91) type 252!\n  [251067.629212] ------------[ cut here ]------------\n  [251067.630033] BTRFS: Transaction aborted (error -75)\n  [251067.630871] WARNING: fs/btrfs/transaction.c:1907 at create_pending_snapshot.cold+0x52/0x465 [btrfs], CPU#10: btrfs/615235\n  [251067.632851] Modules linked in: btrfs dm_zero (...)\n  [251067.644071] CPU: 10 UID: 0 PID: 615235 Comm: btrfs Tainted: G        W           6.19.0-rc8-btrfs-next-225+ #1 PREEMPT(full)\n  [251067.646165] Tainted: [W]=WARN\n  [251067.646733] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n  [251067.648735] RIP: 0010:create_pending_snapshot.cold+0x55/0x465 [btrfs]\n  [251067.649984] Code: f0 48 0f (...)\n  [251067.653313] RSP: 0018:ffffce644908fae8 EFLAGS: 00010292\n  [251067.653987] RAX: 00000000ffffff01 RBX: ffff8e5639e63a80 RCX: 00000000ffffffd3\n  [251067.655042] RDX: ffff8e53faa76b00 RSI: 00000000ffffffb5 RDI: ffffffffc0919750\n  [251067.656077] RBP: ffffce644908fbd8 R08: 0000000000000000 R09: ffffce644908f820\n  [251067.657068] R10: ffff8e5adc1fffa8 R11: 0000000000000003 R12: ffff8e53c0431bd0\n  [251067.658050] R13: ffff8e5414593600 R14: ffff8e55efafd000 R15: 00000000ffffffb5\n  [251067.659019] FS:  00007f2a4944b3c0(0000) GS:ffff8e5b27dae000(0000) knlGS:0000000000000000\n  [251067.660115] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [251067.660943] CR2: 00007ffc5aa57898 CR3: 00000005813a2003 CR4: 0000000000370ef0\n  [251067.661972] Call Trace:\n  [251067.662292]  \u003cTASK\u003e\n  [251067.662653]  create_pending_snapshots+0x97/0xc0 [btrfs]\n  [251067.663413]  btrfs_commit_transaction+0x26e/0xc00 [btrfs]\n  [251067.664257]  ? btrfs_qgroup_convert_reserved_meta+0x35/0x390 [btrfs]\n  [251067.665238]  ? _raw_spin_unlock+0x15/0x30\n  [251067.665837]  ? record_root_\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"btrfs: fix transaction abort when snapshotting received subvolumes","id":"CVE-2026-43361","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":6,"next":{"headline":"smb: client: fix in-place encryption corruption in SMB2_write()","id":"CVE-2026-43362"},"packages":[],"prev":{"headline":"btrfs: fix transaction abort on file creation due to name hash collision","id":"CVE-2026-43360"},"products":["Linux"],"published":"2026-05-08","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A local user can trigger a transaction abort in the btrfs filesystem by repeatedly snapshotting received subvolumes, forcing the filesystem into read-only mode.","url":"https://insights.sbomify.com/CVE-2026-43361/"}