All vulnerabilities
CVE-2026-98081

Linux: btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in433d52b196a689b18dcfadc7cf6c784f0e5cc7c9Also 36b9cdab44848f25879ca625275c92b007f84653, 40370f02a1ca3760f8925ffcbe76eb4d91ea758dCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 433d52b196a689b18dcfadc7cf6c784f0e5cc7c9LinuxCVE List
  • 36b9cdab44848f25879ca625275c92b007f84653LinuxCVE List
  • 40370f02a1ca3760f8925ffcbe76eb4d91ea758dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

do_zone_finish() clears BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE before finishing the zones. If call_zone_finish() then fails it returned early, leaving the now inactive block group on fs_info->zone_active_bgs, leaking its reference, the BTRFS_FS_NEED_ZONE_FINISH waiters are never woken, and as its alloc_offset equals the zone capacity btrfs_zone_finish_one_bg() keeps selecting it, spinning btrfs_zoned_activate_one_bg().

Fall through to the cleanup on failure too and return the error, but keep the block group read-only as its zones are left inconsistent.

Text from CVE List

Affected versions 12

  • Linuxaffected: d70cbdda75da3f258118a558c087157e073229fb before 433d52b196a689b18dcfadc7cf6c784f0e5cc7c9CVE List
  • Linuxaffected: d70cbdda75da3f258118a558c087157e073229fb before 36b9cdab44848f25879ca625275c92b007f84653CVE List
  • Linuxaffected: d70cbdda75da3f258118a558c087157e073229fb before 40370f02a1ca3760f8925ffcbe76eb4d91ea758dCVE List
  • Linuxaffected: d70cbdda75da3f258118a558c087157e073229fb before e1b168a53174b385e3548bfbd079513b22ac240cCVE List
  • Linuxaffected: d70cbdda75da3f258118a558c087157e073229fb before a18a6b93a2843b9d103d3456bbd4b3f90282a379CVE List
  • Linuxaffected: 5.19CVE List
  • Linuxunaffected: all versions before 5.19CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5