---
id: CVE-2026-45974
title: 'btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found

  If btrfs_search_slot_for_read() returns 1, it means we did not find any
  key greater than or…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 <
    023545e272f369d487e6a986c1e321c6e04be1da
  - >-
    Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 <
    fd4913a53e3b54ad7e161847291439fe445d6356
  - >-
    Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 <
    b5b8ade9da452086e78f5d519b90d3769e354853
  - >-
    Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 <
    1ee1d006c9fe4d6be5527ab1c84216b80cccbe40
  - >-
    Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 <
    0761447f6f51e1c7997960d8e6559337deed6729
  - >-
    Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 <
    d7cf2314dd5e8661c05d076cd627eea9a7f76616
  - >-
    Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 <
    b2bd557b75b760e4b9d209112bda19314bd64558
  - >-
    Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 <
    ecb7c2484cfc83a93658907580035a8adf1e0a92
  - Linux ecce1be9f2a366990d0e75dd249fb324e83c34a9
  - Linux >= 5.9.7 < 5.10
  - Linux 5.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:03:33.408323Z'
published: '2026-05-27'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:13:29.272Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45974'
references:
  - url: 'https://git.kernel.org/stable/c/023545e272f369d487e6a986c1e321c6e04be1da'
  - url: 'https://git.kernel.org/stable/c/fd4913a53e3b54ad7e161847291439fe445d6356'
  - url: 'https://git.kernel.org/stable/c/b5b8ade9da452086e78f5d519b90d3769e354853'
  - url: 'https://git.kernel.org/stable/c/1ee1d006c9fe4d6be5527ab1c84216b80cccbe40'
  - url: 'https://git.kernel.org/stable/c/0761447f6f51e1c7997960d8e6559337deed6729'
  - url: 'https://git.kernel.org/stable/c/d7cf2314dd5e8661c05d076cd627eea9a7f76616'
  - url: 'https://git.kernel.org/stable/c/b2bd557b75b760e4b9d209112bda19314bd64558'
  - url: 'https://git.kernel.org/stable/c/ecb7c2484cfc83a93658907580035a8adf1e0a92'
tags:
  - cve.org
epss: 0.00128
epssPercentile: 0.02473
ingestedAt: '2026-11-06T16:57:43.359Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found

If btrfs_search_slot_for_read() returns 1, it means we did not find any
key greater than or equals to the key we asked for, meaning we have
reached the end of the tree and therefore the path is not valid. If
this happens we need to break out of the loop and stop, instead of
continuing and accessing an invalid path.

## Affected

- `Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 < 023545e272f369d487e6a986c1e321c6e04be1da`
- `Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 < fd4913a53e3b54ad7e161847291439fe445d6356`
- `Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 < b5b8ade9da452086e78f5d519b90d3769e354853`
- `Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 < 1ee1d006c9fe4d6be5527ab1c84216b80cccbe40`
- `Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 < 0761447f6f51e1c7997960d8e6559337deed6729`
- `Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 < d7cf2314dd5e8661c05d076cd627eea9a7f76616`
- `Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 < b2bd557b75b760e4b9d209112bda19314bd64558`
- `Linux >= 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 < ecb7c2484cfc83a93658907580035a8adf1e0a92`
- `Linux ecce1be9f2a366990d0e75dd249fb324e83c34a9`
- `Linux >= 5.9.7 < 5.10`
- `Linux 5.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.