All vulnerabilities
CVE-2026-98269

Linux: btrfs: abort transaction on failure to update inode for hole punching and reflinking

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067dAlso 834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6, 9588850bfa75c78ce73c2f6f72544d19d2e9beb6 and 2 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067dLinuxCVE List
  • 834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6LinuxCVE List
  • 9588850bfa75c78ce73c2f6f72544d19d2e9beb6LinuxCVE List
  • 36c68dc909845c049e0286d229bc502947239452LinuxCVE List
  • 97fcd34aa9fd73cefe3120ac9a82ca9d7763922fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: abort transaction on failure to update inode for hole punching and reflinking

If we fail to update the inode we error out without aborting the transaction, which can result in a persistent inconsistency if after the failure the transaction is committed, as we have dropped file extent items from a range and either punched a hole or insert a new file extent item for that range (for reflinks).

So add the missing transaction abort.

Text from CVE List

Affected versions 12

  • Linuxaffected: 2aaa66558172b017f36bf38ae69372813dedee9d before 2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067dCVE List
  • Linuxaffected: 2aaa66558172b017f36bf38ae69372813dedee9d before 834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6CVE List
  • Linuxaffected: 2aaa66558172b017f36bf38ae69372813dedee9d before 9588850bfa75c78ce73c2f6f72544d19d2e9beb6CVE List
  • Linuxaffected: 2aaa66558172b017f36bf38ae69372813dedee9d before 36c68dc909845c049e0286d229bc502947239452CVE List
  • Linuxaffected: 2aaa66558172b017f36bf38ae69372813dedee9d before 97fcd34aa9fd73cefe3120ac9a82ca9d7763922fCVE List
  • Linuxaffected: 3.7CVE List
  • Linuxunaffected: all versions before 3.7CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5