Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2026-98083

btrfs: fix transaction use-after-free in raid stripe insertion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM. btrfs_finish_one_ordered(), the production caller through btrfs_insert_raid_extent(), still owns the transaction handle. It handles the error by aborting the transaction and then reaches the common exit path, which ends the transaction again. The premature end can free the handle and drop its transaction reference. Transaction cleanup can then free the transaction before the caller's second abort accesses the handle and transaction, resulting in use-after-free. Keep the abort at the failure site, but let the caller's common exit path end the transaction once, after it has finished using both objects.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • ab69bf6f8970c09d3735c25094e9471d54365282 to < 089d9c45ea49ffffe55a8fe08d0ce2536626e90aaffected
  • 02c372e1f016e5113217597ab37b399c4e407477 to < b185bdf30313e213fa1c887fe22fc3d513c061d9affected
  • 02c372e1f016e5113217597ab37b399c4e407477 to < 2fbfd02bdfe12b20bd3cc7a3190fb32e3f7072f5affected
  • 02c372e1f016e5113217597ab37b399c4e407477 to < b7b94923b3b5774d85a2a7c8d6eb9e3e0ef66685affected
  • 02c372e1f016e5113217597ab37b399c4e407477 to < a8813a923f9e43f788b357fb55c35f7f6ed6f98caffected
  • 6.6.130 to < 6.6.158affected

Linux Linux

Default version status: affected

  • 6.7affected
  • 0 to < 6.7unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.2.7 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References