CVE-2026-46159

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the btrfs ioctl space info() function. The function performs two passes over block group RAID type lists: the first to determine allocation size and the second to fill the buffer. Because the groups sem rwlock is released between these passes, a concurrent block group removal can reduce the entry count. Consequently, copy to user() may copy the full allocation size, including uninitialized kmalloc bytes, to userspace, resulting in an information leak.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.