CVE-2026-23181

A race condition was found in the Linux kernel's Btrfs filesystem when reading the disk superblock. If a user changes the block device's block size via BLKBSZSET ioctl while Btrfs is mounting, the inconsistency between folio allocation and the new block size can trigger a VM_BUG_ON assertion or NULL pointer dereference.

Exploitation requires the ability to issue BLKBSZSET ioctls on a block device being mounted with Btrfs, which typically needs CAP_SYS_ADMIN or device ownership. The race window is narrow and the impact is denial of service via kernel crash rather than privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.