CVE-2026-46159

A flaw was found in the btrfs filesystem within the Linux kernel. A Time-of-check to time-of-use (TOCTOU) race condition in the btrfs_ioctl_space_info() function allows a local attacker to exploit a timing window. This occurs when the system counts entries for allocation size and then fills a buffer, but a concurrent operation reduces the entry count between these two steps. Consequently, uninitialized kernel memory may be copied to userspace, leading to information disclosure.

This vulnerability is rated as Moderate because it requires local access to interact with a mounted Btrfs filesystem to trigger the race condition, and the impact is confined to leaking uninitialized kernel heap memory rather than code execution or system disruption. To exploit this flaw, a local user must execute specific control operations concurrently with filesystem allocation changes on a target volume. Additionally, Btrfs is not supported or enabled on standard enterprise configurations across modern Red Hat Enterprise Linux releases, significantly reducing practical exposure in typical customer deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.