All vulnerabilities
CVE-2026-98090

Linux: btrfs: restore active device pointers after failed sprout

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in46863a9f93186e620c70584f91c8d5d95da83effAlso 49179f13c04735c55fd0f43b03696c015b067137, 0a0ee38ad6324ac1603079bb785f784191576bd5 and 2 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 46863a9f93186e620c70584f91c8d5d95da83effLinuxCVE List
  • 49179f13c04735c55fd0f43b03696c015b067137LinuxCVE List
  • 0a0ee38ad6324ac1603079bb785f784191576bd5LinuxCVE List
  • 2ee5c4bc11007c51f63f0c1be5d3f07f2b404ff7LinuxCVE List
  • 5.15.222LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: restore active device pointers after failed sprout

btrfs_init_new_device() switches latest_dev and possibly s_bdev from the seed device to the new sprout device before creating the first writable chunks.

If chunk creation or the subsequent sprout setup fails, the error path releases the new device without switching those pointers back. btrfs_show_devname() can then dereference the freed latest_dev and crash.

Restore the active device pointers to the latest seed device before removing and releasing the failed sprout device.

Text from CVE List

Affected versions 17

  • Linuxaffected: a6e7e218a4d6488d56727a7d9aee1b7e78c0c485 before 46863a9f93186e620c70584f91c8d5d95da83effCVE List
  • Linuxaffected: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c before 49179f13c04735c55fd0f43b03696c015b067137CVE List
  • Linuxaffected: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c before 0a0ee38ad6324ac1603079bb785f784191576bd5CVE List
  • Linuxaffected: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c before 2ee5c4bc11007c51f63f0c1be5d3f07f2b404ff7CVE List
  • Linuxaffected: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c before e127ac29a52134d0f4cba39d38e4b375deb3d1aaCVE List
  • Linuxaffected: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c before b79b4b29003690acfade8241998fc0104ef9c84cCVE List
  • Linuxaffected: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c before e0b54613aabeb8e9da597f23b90c6a03d0981986CVE List
  • Linuxaffected: 5.15.11 before 5.15.222CVE List
  • Linuxaffected: 5.16CVE List
  • Linuxunaffected: all versions before 5.16CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7