CVE-2026-46159

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak btrfs_ioctl_space_info() has a TOCTOU race between two passes over the block group RAID type lists. The first pass counts entries to determine the allocation size, then the second pass fills the buffer. The groups_sem rwlock is released between passes, allowing concurrent block group removal to reduce the entry count. When the second pass fills fewer entries than the first pass counted, copy_to_user() copies the full alloc_size bytes including trailing uninitialized kmalloc bytes to userspace. Fix by copying only total_spaces entries (the actually-filled count from the second pass) instead of alloc_size bytes, and switch to kzalloc so any future copy size mismatch cannot leak heap data.

• CWE-367

• https://git.kernel.org/stable/c/4fdc6ee0802121d9cd96b8d085e589f51e5a4ec3Patch
• https://git.kernel.org/stable/c/5d12e0ab009ade48c1bff9324fd9bea2c773d088Patch
• https://git.kernel.org/stable/c/973e57c726c1f8e77259d1c8e519519f1e9aea77Patch
• https://git.kernel.org/stable/c/d09d67d5de577cedae3de9497dff217e0ac8b641Patch
• https://git.kernel.org/stable/c/d69a4a6813fdba7c4cc3695a7e843842b240790d
• https://git.kernel.org/stable/c/d8224b1be6627c6c3b204bfb264508d27c65ac44
• https://git.kernel.org/stable/c/f407aad350bdea4db300c47433573b7a41630d33
• https://git.kernel.org/stable/c/f5ee467b56764964027c361641f64953fc0f8f9aPatch

Published

May 28, 2026

Last Modified

Jun 19, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46153In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46154In the Linux kernel, the following vulnerability has been re…7
• CVE-2026-46155In the Linux kernel, the following vulnerability has been re…9.1
• CVE-2026-46156In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46157In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-46158In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-4616A security flaw has been discovered in bolo-blog up to 2.6.4…2.4
• CVE-2026-46160In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46161In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46162In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-46163In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-46164In the Linux kernel, the following vulnerability has been re…7