What’s Vulnerable › Vulnerabilities

CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-08 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() There is no need to BUG(), we can just return an error and log an error message.

Affected products

• Linux kernel: from 2.6.31 before 6.19.6 — fixed in 6.19.6
• Linux: 2.6.31 — fixed in 7.0

How to fix

Upgrade to a fixed version: Linux kernel 6.19.6; Linux 7.0. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0e77f1c8ebf5b1f858b5ac613baceb79919d6d3f
• https://git.kernel.org/stable/c/5549743e11c06da23cfa7712a994b9f1e69064c6
• https://git.kernel.org/stable/c/6ad4caadc6343c3d7987bf3211f15d66135c4c42
• https://git.kernel.org/stable/c/a5ac87aabdedd31e832b40466605e83f428136aa
• https://git.kernel.org/stable/c/c614b64bee2c3cbb0c80dd3a9ee492c74364e275
• https://git.kernel.org/stable/c/c7d1d4ff56744074e005771aff193b927392d51f

Get alerted when CVE-2026-43308 or the next vulnerability affects your stack