btrfs: fix zero size inode with non-zero size after log replay
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix zero size inode with non-zero size after log replay When logging that an inode exists, as part of logging a new name or logging new dir entries for a directory, we always set the generation of the logged inode item to 0. This is to signal during log replay (in overwrite_item()), that we should not set the i_size since we only logged that an inode exists, so the i_size of the inode in the subvolume tree must be preserved (as when we log new names or that an inode exists, we don't log extents). This works fine except when we have already logged an inode in full mode or it's the first time we are logging an inode created in a past transaction, that inode has a new i_size of 0 and then we log a new name for the inode (due to a new hardlink or a rename), in which case we log an i_size of 0 for the inode and a generation of 0, which causes the log replay code to not update the inode's i_size to 0 (in overwrite_item()). An example scenario: mkdir /mnt/dir xfs_io -f -c "pwrite 0 64K" /mnt/dir/foo sync xfs_io -c "truncate 0" -c "fsync" /mnt/dir/foo ln /mnt/dir/foo /mnt/dir/bar xfs_io -c "fsync" /mnt/dir After log replay the file remains with a size of 64K. This is because when we first log the inode, when we fsync file foo, we log its current i_size of 0, and then when we create a hard link we log again the inode in exists mode (LOG_INODE_EXISTS) but we set a generation of 0 for the inode item we add to the
CVE-2026-43118
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-43118
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"lessThan": "c939bfa67d221f75351a5bf2fc912e8125547b7e",
"versionType": "git"
},
{
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"lessThan": "91990732ec4ce5c09361d498c6d621f5a76ee1f2",
"versionType": "git"
},
{
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"lessThan": "fddb157536e67a055597f00a8b4922d5f5ed0826",
"versionType": "git"
},
{
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"lessThan": "03e966b63df5b06790310c1faaf3e0cb43adea8b",
"versionType": "git"
},
{
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"lessThan": "5254d4181add9dfaa5e3519edd71cc8f752b2f85",
"versionType": "git"
}
],
"programFiles": [
"fs/btrfs/tree-log.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.30",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/btrfs/tree-log.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-43118
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46261 · Revision 1
- Added to Heist Feed
- Publisher date