Security readout for executives and security teams
Plain-English summary
This is a Linux kernel Btrfs filesystem bug that can make a filesystem fail to mount after a crash or power loss in a specific directory-removal scenario. The business impact is primarily availability and possible recovery effort, not remote compromise based on the provided sources.
Executive priority
Treat as a focused reliability risk for Btrfs systems, especially servers where post-crash mount failure would disrupt operations. Prioritize patching during normal kernel maintenance unless critical Btrfs workloads face high crash or power-loss risk.
Technical view
Btrfs did not update a removed directory’s last_unlink_trans field. If a process still holds a directory file descriptor, then fsync occurs after rmdir, and power fails, later tree-log replay can fail with -EIO and report invalid directory link counts.
Likely exposure
Exposure appears limited to Linux systems using Btrfs. Non-Btrfs filesystems are not implicated by the sources. Exact exposure depends on kernel version and distribution backports; the CVE references upstream stable commits but does not provide a simple distribution matrix.
Exploitation context
No active exploitation is indicated; the CVE is not marked KEV in the provided data. Triggering requires local filesystem activity involving directory movement/removal, fsync on an open directory descriptor, and an unclean shutdown or power failure.
Researcher notes
The source describes a deterministic filesystem consistency bug, not a privilege-escalation or remote attack path. Severity and CVSS are absent. Affected version data in the bundle is not distribution-ready, so validation should rely on vendor kernel advisories and commit inclusion.
Mitigation direction
- Apply Linux kernel or distribution updates containing the referenced Btrfs stable commits.
- Check distribution advisories for the exact fixed kernel package for your platform.
- Prioritize Btrfs hosts where mount availability is business critical.
- Maintain tested backups and recovery procedures for affected Btrfs systems.
Validation and detection
- Inventory Linux systems using Btrfs filesystems.
- Map running kernels to vendor advisories or the referenced upstream stable commits.
- Review boot and kernel logs for Btrfs tree-log replay failures or invalid nlink messages.
- Confirm updated kernels are running after maintenance windows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-46160 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cc3c0a0f965754ce230d93ba44ee5b34fbe6138aCVE reference, Linux
- https://git.kernel.org/stable/c/aa9c3ecaf7337df3a689318584f879b5339ede0fCVE reference, Linux
- https://git.kernel.org/stable/c/fb388eb58c1ba047ccabc33901839acfecadcf49CVE reference, Linux
- https://git.kernel.org/stable/c/36fcc2c7517f8a86379154c9793f867592aa8b7eCVE reference, Linux
- https://git.kernel.org/stable/c/999757231c49376cd1a37308d2c8c4c9932571e1CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.