All vulnerabilities
CVE-2026-98082

Linux: btrfs: fix the possible bioc_list memory leak during error

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in83f0c973cffb184d019390ffdb5d31de5c85bc61Also 1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0, 6.6.158CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 83f0c973cffb184d019390ffdb5d31de5c85bc61LinuxCVE List
  • 1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0LinuxCVE List
  • 6.6.158LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix the possible bioc_list memory leak during error

There are two possible ways to leak bioc memory on btrfs_ordered_extent::bioc_list:

  • An error occurred for btrfs_insert_one_raid_extent()

Then the function btrfs_insert_raid_extent() immediately return without freeing any bioc in the bioc_list.

  • An ordered extent hit an IO error

In that case the ordered extent will have BTRFS_ORDERED_IOERR set, and skip the call on btrfs_insert_raid_extent() completely.

Fix the problem by:

  • Introduce a new helper, btrfs_cleanup_ordered_bioc_list()

Which will remove all bioc from the bioc_list, and release the bioc.

  • Call the above helper for btrfs_insert_raid_extent()

So that the cleanup helper is always called no matter what.

  • Call the above helper for btrfs_finish_one_ordered()

This is called just before the final release on the ordered extent.

This was reported by Sashiko when reviewing another patch.

Text from CVE List

Affected versions 13

  • Linuxaffected: ab69bf6f8970c09d3735c25094e9471d54365282 before d043c43d2b4ebcd75ee7f907948ef2847306d6b2CVE List
  • Linuxaffected: 02c372e1f016e5113217597ab37b399c4e407477 before 83f0c973cffb184d019390ffdb5d31de5c85bc61CVE List
  • Linuxaffected: 02c372e1f016e5113217597ab37b399c4e407477 before 1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0CVE List
  • Linuxaffected: 02c372e1f016e5113217597ab37b399c4e407477 before bb4da45766d16503821f167054db76b735d89e94CVE List
  • Linuxaffected: 02c372e1f016e5113217597ab37b399c4e407477 before afbe73778338e6d1ac8c4486fbdf33f0cc1f2624CVE List
  • Linuxaffected: 6.6.130 before 6.6.158CVE List
  • Linuxaffected: 6.7CVE List
  • Linuxunaffected: all versions before 6.7CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5