Critical 9.1Published May 6, 2026

CVE-2026-43117btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb.

CVSS: 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from bc074524e123ded281cde25ebc5661910f9679e3 before 4a7bab35fad5251c8cb738161152578cd83b6b9c; from bc074524e123ded281cde25ebc5661910f9679e3 before 520e8b4bcf872a534a7bf61ccf880047642df296; from bc074524e123ded281cde25ebc5661910f9679e3 before e252db8ca2a01f82d472091f35d549b313278636; from bc074524e123ded281cde25ebc5661910f9679e3 before c09a7446aab5773f38d6abb25fce99b8e1dfbc97; from bc074524e123ded281cde25ebc5661910f9679e3 before 32372781d664a9b03c40343e96c29d0a6139f97d; from bc074524e123ded281cde25ebc5661910f9679e3 before 2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a; from bc074524e123ded281cde25ebc5661910f9679e3 before d110d7cdb045715c0b45b0dfd974525bb38f653d; from bc074524e123ded281cde25ebc5661910f9679e3 before a85b46db143fda5869e7d8df8f258ccef5fa1719	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.8 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 7.0; 7.0; 7.0; 7.0; and 1 more ranges	NVD

References

https://git.kernel.org/stable/c/4a7bab35fad5251c8cb738161152578cd83b6b9c
https://git.kernel.org/stable/c/520e8b4bcf872a534a7bf61ccf880047642df296
https://git.kernel.org/stable/c/e252db8ca2a01f82d472091f35d549b313278636
https://git.kernel.org/stable/c/c09a7446aab5773f38d6abb25fce99b8e1dfbc97patch
https://git.kernel.org/stable/c/32372781d664a9b03c40343e96c29d0a6139f97dpatch
https://git.kernel.org/stable/c/2e4adfaec97ee053ad1bdfb5036845e66f7e0d8apatch
https://git.kernel.org/stable/c/d110d7cdb045715c0b45b0dfd974525bb38f653dpatch
https://git.kernel.org/stable/c/a85b46db143fda5869e7d8df8f258ccef5fa1719patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.