Answer in brief
CVE-2026-23465 records a Medium severity (CVSS 5.5) vulnerability in btrfs: log new dentries when logging parent dir of a conflicting inode. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a3baaf0d786e22fc86295fda9c58ba0dee07599f <6c23595c54cfeb878e3fbbb8eb08bc5061d0c2d4 || >=a3baaf0d786e22fc86295fda9c58ba0dee07599f <56e72c8b02d982be775d9df025357c152383ee84 || >=a3baaf0d786e22fc86295fda9c58ba0dee07599f <f556b1e09d054e31f464c0fd37280c2b5a393fee || >=a3baaf0d786e22fc86295fda9c58ba0dee07599f <1cf30c73602c69d750c9345c47f2c0e9d0cfb578 || >=a3baaf0d786e22fc86295fda9c58ba0dee07599f <6f5a51969b1deb79aefd2194b48fe7e78e72ff7e || >=a3baaf0d786e22fc86295fda9c58ba0dee07599f <9573a365ff9ff45da9222d3fe63695ce562beb24 | 6c23595c54cfeb878e3fbbb8eb08bc5061d0c2d4, 56e72c8b02d982be775d9df025357c152383ee84, f556b1e09d054e31f464c0fd37280c2b5a393fee, 1cf30c73602c69d750c9345c47f2c0e9d0cfb578, 6f5a51969b1deb79aefd2194b48fe7e78e72ff7e, 9573a365ff9ff45da9222d3fe63695ce562beb24 |
| Linux/Linuxgeneric | 5.1 | Not reported |
Published upstream
Apr 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 30, 2026
In the Linux kernel, the following vulnerability has been resolved: btrfs: log new dentries when logging parent dir of a conflicting inode If we log the parent directory of a conflicting inode, we are not logging the new dentries of the directory, so when we finish we have the parent directory's inode marked as logged but we did not log its new dentries. As a consequence if the parent directory is explicitly fsynced later and it does not have any new changes since we logged it, the fsync is a no-op and after a power failure the new dentries are missing. Example scenario: $ mkdir foo $ sync $rmdir foo $ mkdir dir1 $ mkdir dir2 # A file with the same name and parent as the directory we just deleted # and was persisted in a past transaction. So the deleted directory's # inode is a conflicting inode of this new file's inode. $ touch foo $ ln foo dir2/link # The fsync on dir2 will log the parent directory (".") because the # conflicting inode (deleted directory) does not exists anymore, but it # it does not log its new dentries (dir1). $ xfs_io -c "fsync" dir2 # This fsync on the parent directory is no-op, since the previous fsync # logged it (but without logging its new dentries). $ xfs_io -c "fsync" . <power failure> # After log replay dir1 is missing. Fix this by ensuring we log new dir dentries whenever we log the parent directory of a no longer existing conflicting inode. A test case for fstests will follow soon.
Quoted source text, attributed separately from HOL analysis.