CVE-2026-46159 Details

A vulnerability in the Linux kernel's Btrfs file system has been addressed, which involved a time-of-check to time-of-use (TOCTOU) race condition in the 'btrfs_ioctl_space_info' function. This vulnerability allowed an information leak due to the function's two-pass processing over block group RAID type lists. The first pass counted entries to determine the allocation size, while the second pass filled the buffer. The 'groups_sem' read-write lock was released between these passes, permitting concurrent block group removals that could decrease the entry count. Consequently, if the second pass filled fewer entries than the first pass counted, the 'copy_to_user' function would inadvertently transfer the full allocated size bytes, including uninitialized data from the kernel heap, to user space. The vulnerability has been fixed by ensuring that only the actually filled count is copied to user space and by using a safer memory allocation method that prevents future leaks of heap data.

Users can upgrade to the latest stable version of the Linux kernel where this vulnerability has been patched. Instructions for downloading the latest version can be found on the official Linux kernel website.