PT-2026-30159 · Linux+1 · Linux Kernel+1

Published 2026-04-03 · Updated 2026-05-26 · CVE-2026-23465

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the btrfs subsystem related to how it handles logging of directory entries (dentries) when a conflicting inode is encountered. Specifically, when logging the parent directory of a conflicting inode, the system fails to log the new dentries of that directory. This can lead to data loss in scenarios involving file system synchronization (fsync) followed by a power failure. The issue arises because the parent directory is marked as logged, but its new entries are not, resulting in a no-op fsync and subsequent loss of the new dentries after a system interruption. An example scenario involves creating, deleting, and recreating directories and files with the same name and parent, followed by an fsync operation on the parent directory. The fix involves ensuring that new directory entries are logged whenever the parent directory of a no longer existing conflicting inode is logged.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-23465

ECHO-8217-458D-2301

Affected Products

Linux Kernel

Btrfs

References · 18

• https://git.kernel.org/stable/c/6f5a51969b1deb79aefd2194b48fe7e78e72ff7e · Patch
• https://ubuntu.com/security/CVE-2026-23465 · Vendor Advisory
• https://git.kernel.org/stable/c/f556b1e09d054e31f464c0fd37280c2b5a393fee · Patch
• https://cve.org/CVERecord?id=CVE-2026-23465 · Security Note
• https://git.kernel.org/stable/c/9573a365ff9ff45da9222d3fe63695ce562beb24 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-23465 · Vendor Advisory
• https://git.kernel.org/stable/c/56e72c8b02d982be775d9df025357c152383ee84 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23465 · Vendor Advisory
• https://git.kernel.org/stable/c/1cf30c73602c69d750c9345c47f2c0e9d0cfb578 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23465 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23465 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23465 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23465 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23465 · Vendor Advisory
• https://docs.bell-sw.com/security/cves/CVE-2026-23465 · Note