All vulnerabilities
CVE-2026-98083

Linux: btrfs: fix transaction use-after-free in raid stripe insertion

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in089d9c45ea49ffffe55a8fe08d0ce2536626e90aAlso 2fbfd02bdfe12b20bd3cc7a3190fb32e3f7072f5, 6.6.158CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 089d9c45ea49ffffe55a8fe08d0ce2536626e90aLinuxCVE List
  • 2fbfd02bdfe12b20bd3cc7a3190fb32e3f7072f5LinuxCVE List
  • 6.6.158LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix transaction use-after-free in raid stripe insertion

If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM.

btrfs_finish_one_ordered(), the production caller through btrfs_insert_raid_extent(), still owns the transaction handle. It handles the error by aborting the transaction and then reaches the common exit path, which ends the transaction again.

The premature end can free the handle and drop its transaction reference. Transaction cleanup can then free the transaction before the caller's second abort accesses the handle and transaction, resulting in use-after-free.

Keep the abort at the failure site, but let the caller's common exit path end the transaction once, after it has finished using both objects.

Text from CVE List

Affected versions 13

  • Linuxaffected: ab69bf6f8970c09d3735c25094e9471d54365282 before 089d9c45ea49ffffe55a8fe08d0ce2536626e90aCVE List
  • Linuxaffected: 02c372e1f016e5113217597ab37b399c4e407477 before b185bdf30313e213fa1c887fe22fc3d513c061d9CVE List
  • Linuxaffected: 02c372e1f016e5113217597ab37b399c4e407477 before 2fbfd02bdfe12b20bd3cc7a3190fb32e3f7072f5CVE List
  • Linuxaffected: 02c372e1f016e5113217597ab37b399c4e407477 before b7b94923b3b5774d85a2a7c8d6eb9e3e0ef66685CVE List
  • Linuxaffected: 02c372e1f016e5113217597ab37b399c4e407477 before a8813a923f9e43f788b357fb55c35f7f6ed6f98cCVE List
  • Linuxaffected: 6.6.130 before 6.6.158CVE List
  • Linuxaffected: 6.7CVE List
  • Linuxunaffected: all versions before 6.7CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5