CVE-2026-46159 btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak

🗓️ 28 May 2026 09:36:14Reported by LinuxType

CVE-2026-46159 fixes btrfs_ioctl_space_info TOCTOU race that could leak info by copying only filled entries.

Reporter	Title	Published	Views	Family All 264
ATTACKERKB	CVE-2026-46159	28 May 202609:36	–	attackerkb
CNNVD	Linux kernel 安全漏洞	28 May 202600:00	–	cnnvd
CVE	CVE-2026-46159	28 May 202609:36	–	cve
Debian CVE	CVE-2026-46159	28 May 202609:36	–	debiancve
EUVD	EUVD-2026-32786	28 May 202609:36	–	euvd
Microsoft CVE	btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak	29 May 202608:04	–	mscve
NVD	CVE-2026-46159	28 May 202610:16	–	nvd
OSV	BELL-CVE-2026-46159	29 May 202606:09	–	osv
OSV	DEBIAN-CVE-2026-46159	28 May 202610:16	–	osv
OSV	ECHO-CCC0-D8EF-5C37	28 May 202623:19	–	osv

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "fs/btrfs/ioctl.c"
    ],
    "versions": [
      {
        "version": "7fde62bffb576d384ea49a3aed3403d5609ee5bc",
        "lessThan": "f5ee467b56764964027c361641f64953fc0f8f9a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "7fde62bffb576d384ea49a3aed3403d5609ee5bc",
        "lessThan": "4fdc6ee0802121d9cd96b8d085e589f51e5a4ec3",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "7fde62bffb576d384ea49a3aed3403d5609ee5bc",
        "lessThan": "5d12e0ab009ade48c1bff9324fd9bea2c773d088",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "7fde62bffb576d384ea49a3aed3403d5609ee5bc",
        "lessThan": "d09d67d5de577cedae3de9497dff217e0ac8b641",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "7fde62bffb576d384ea49a3aed3403d5609ee5bc",
        "lessThan": "973e57c726c1f8e77259d1c8e519519f1e9aea77",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "fs/btrfs/ioctl.c"
    ],
    "versions": [
      {
        "version": "2.6.34",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "2.6.34",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.140",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.90",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.32",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0.7",
        "lessThanOrEqual": "7.0.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1-rc1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/5d12e0ab009ade48c1bff9324fd9bea2c773d088
git	www.git.kernel.org/stable/c/4fdc6ee0802121d9cd96b8d085e589f51e5a4ec3
git	www.git.kernel.org/stable/c/f5ee467b56764964027c361641f64953fc0f8f9a
git	www.git.kernel.org/stable/c/d09d67d5de577cedae3de9497dff217e0ac8b641
git	www.git.kernel.org/stable/c/973e57c726c1f8e77259d1c8e519519f1e9aea77

28 May 2026 09:36Current

EPSS0.00012