CVE-2026-43118

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix zero size inode with non-zero size after log replay

When logging that an inode exists, as part of logging a new name or logging new dir entries for a directory, we always set the generation of the logged inode item to 0. This is to signal during log replay (in overwriteitem()), that we should not set the isize since we only logged that an inode exists, so the i_size of the inode in the subvolume tree must be preserved (as when we log new names or that an inode exists, we don't log extents).

This works fine except when we have already logged an inode in full mode or it's the first time we are logging an inode created in a past transaction, that inode has a new isize of 0 and then we log a new name for the inode (due to a new hardlink or a rename), in which case we log an isize of 0 for the inode and a generation of 0, which causes the log replay code to not update the inode's isize to 0 (in overwriteitem()).

An example scenario:

mkdir /mnt/dir xfs_io -f -c "pwrite 0 64K" /mnt/dir/foo

sync

xfs_io -c "truncate 0" -c "fsync" /mnt/dir/foo

ln /mnt/dir/foo /mnt/dir/bar

xfs_io -c "fsync" /mnt/dir

<power fail>

After log replay the file remains with a size of 64K. This is because when we first log the inode, when we fsync file foo, we log its current isize of 0, and then when we create a hard link we log again the inode in exists mode (LOGINODEEXISTS) but we set a generation of 0 for the inode item we add to the log tree, so during log replay overwriteitem() sees that the generation is 0 and isize is 0 so we skip updating the inode's isize from 64K to 0.

Fix this by making sure at fillinodeitem() we always log the real generation of the inode if it was logged in the current transaction with the isize we logged before. Also if an inode created in a previous transaction is logged in exists mode only, make sure we log the isize stored in the inode item located from the commit root, so that if we log multiple times that the inode exists we get the correct i_size.

A test case for fstests will follow soon.