CVE-2023-3111
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().
Risk Assessment
This vulnerability may lead to unexpected system behavior, potentially resulting in data loss or filesystem integrity issues in Btrfs.
Recommendation
It is recommended to avoid calling btrfs_ioctl_balance() before btrfs_ioctl_defrag() and to monitor kernel updates to patch this vulnerability.
Other vulnerabilities in Linux Kernel Btrfs
See all- CVE-2026-90265Unknown
A deadlock exists in the Linux kernel's btrfs filesystem during file defragmentation when autodefrag is enabled. Defrag reserves delalloc space while holding dirty and locked folios plus the extent range lock, causing kernel tasks (btrfs-cleaner, writeback, metadata reclaim) to block each other.
- CVE-2026-89772Low risk· EPSS 7%
A flaw was found in the Linux kernel btrfs subsystem where write-protection of folios during data writeback was lost. A code change replaced folio_clear_dirty_for_io() with a plain folio_test_dirty() check, allowing a process with an mmap-ed file to modify sectors while writeback is in progress. This can cause checksum corruption, lost writes, and data corruption for compressed or inline extents.
Original NVD description (English source)
A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().