CVE-2026-23157
📋 TL;DR
A deadlock vulnerability in the Linux kernel's btrfs filesystem where metadata writeback logic conflicts with cgroup dirty page limits, causing system hangs. Affects Linux systems using btrfs with cgroup memory limits, particularly older kernels before v6.18.
💻 Affected Systems
- Linux kernel
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete system hang requiring hard reboot, potential data loss or corruption from forced shutdown.
Likely Case
Performance degradation or temporary unresponsiveness when btrfs metadata operations coincide with cgroup memory pressure.
If Mitigated
Minimal impact if systems avoid cgroup memory limits on btrfs volumes or use newer kernels with the fix.
🎯 Exploit Status
Exploitation requires specific conditions: btrfs usage with cgroup memory limits causing dirty page threshold conflicts. Not a traditional security exploit but a reliability issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel v6.18 and later
Vendor Advisory: https://git.kernel.org/stable/c/4e159150a9a56d66d247f4b5510bed46fe58aa1c
Restart Required: Yes
Instructions:
1. Update to Linux kernel v6.18 or later. 2. For LTS kernels, apply backported patches from stable kernel trees. 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Increase cgroup memory limits
linuxIncrease memory limits for cgroups using btrfs volumes to avoid hitting dirty page thresholds
echo 'memory.limit_in_bytes=1073741824' > /sys/fs/cgroup/memory/your_cgroup/memory.limit_in_bytes
Disable cgroup memory limits for btrfs
linuxRemove memory limits from cgroups that contain btrfs operations
echo '-1' > /sys/fs/cgroup/memory/your_cgroup/memory.limit_in_bytes
🧯 If You Can't Patch
- Avoid using cgroup memory limits on systems with btrfs volumes
- Monitor system for processes stuck in balance_dirty_pages() and restart affected services
🔍 How to Verify
Check if Vulnerable:
Check kernel version and btrfs usage: uname -r and check if btrfs filesystems are mounted with cgroup memory limitsCheck Version:
uname -rVerify Fix Applied:
Verify kernel version is v6.18 or later: uname -r | grep -E '^6\.(1[8-9]|[2-9][0-9])'📡 Detection & Monitoring
Log Indicators:
- Kernel logs showing processes stuck in balance_dirty_pages()
- High number of processes in D state (uninterruptible sleep)
- System hang events in system logs
Network Indicators:
- None - this is a local filesystem issue
SIEM Query:
process.state:D AND process.name:balance_dirty_pages OR kernel.panic OR system.hang