CVE-2026-43117

Vulnerability

The btrfs tracepoint event btrfs_sync_file() misuses dentry->d_sb to obtain the filesystem's superblock. When overlayfs is layered on top of btrfs, dentry->d_sb points to the overlay's superblock instead of the btrfs superblock, resulting in an invalid fsid assignment and a kernel crash.

Exploitation

An attacker can trigger this vulnerability by mounting an overlay filesystem over a btrfs mount and then performing a filesystem sync (e.g., via fsync()) on a file. No special privileges are required beyond the ability to mount filesystems and execute file operations. The crash occurs during the tracepoint execution, making it accessible to any user who can trigger the btrfs_sync_file() tracepoint under the overlay.

Impact

Successful exploitation leads to a denial of service (kernel crash), rendering the system unavailable. No evidence of data corruption or privilege escalation has been reported; the primary impact is on system availability.

Mitigation

The fix replaces dentry->d_sb with file_inode(file)->i_sb, which always returns the correct btrfs superblock. The patch has been committed to the stable kernel tree (see reference [1]). Users should update to the latest kernel version to remediate the issue.