PT-2026-39021 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-06-15 · CVE-2026-43360

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the btrfs filesystem where creating multiple files with names that result in the same hash can lead to a transaction abort. This occurs because files with colliding hashes are packed into the same directory item, which has a size limit inherent to the leaf size. When this limit is reached, the system triggers a transaction abort and switches the filesystem to read-only mode. This allows a malicious user to disrupt the system without requiring administrative privileges or capabilities.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43360

SUSE-SU-2026:22048-1

SUSE-SU-2026:22076-1

SUSE-SU-2026:22087-1

SUSE-SU-2026:22108-1

Affected Products

Linux Kernel

References · 259

• https://security-tracker.debian.org/tracker/CVE-2026-43360 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22087-1 · Vendor Advisory
• https://git.kernel.org/stable/c/5e2ea10b800d1bbb95e0c01a83f4f8119ac5d688 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:22108-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43360 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43360 · Vendor Advisory
• https://git.kernel.org/stable/c/0625e564290450c1921b115fc3d9abef74e055bd · Patch
• https://ubuntu.com/security/CVE-2026-43360 · Vendor Advisory
• https://git.kernel.org/stable/c/9273175bf16c83f3ec93aa242d78c9b5db452d4d · Patch
• https://cve.org/CVERecord?id=CVE-2026-43360 · Security Note
• https://git.kernel.org/stable/c/2d1ababdedd4ba38867c2500eb7f95af5ddeeef7 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:22076-1 · Vendor Advisory
• https://git.kernel.org/stable/c/36947b5200b89bbe3a63629c12d4b31c84c0af9f · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43360 · Vendor Advisory
• https://git.kernel.org/stable/c/64ad49597d14c495ab8b7933bfefc83936a598e4 · Patch