Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98245

btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() mark_block_group_to_copy() iterates over the commit root with skip_locking=true. A concurrent transaction commit can swap and free the commit root during iteration, causing use-after-free when accessing extent buffers. Fix it by using path->need_commit_sem to protect the commit root search.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to < 90242b776df83f8b1ea901f80b568b4fc2318c61affected
  • 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to < bffe773f92885603db14047bba0f12089105929eaffected
  • 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to < 93a025166495c63ba5b8ac721c7040d5312e8335affected
  • 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to < 8e2007b263ea250251ec3021a0a197da990ee1a8affected
  • 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to < 709f6a5e986535005110c6c69b322f63631cb200affected
  • 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to < c32490c6d3f3a9f2d177d57c7eb8bbc347561d08affected
  • 78ce9fc269af6e69c1399ab910ba6bc81c934f67 to < 0594e3423f4ba3137c734371169491f9a98e9af4affected

Linux Linux

Default version status: affected

  • 5.12affected
  • 0 to < 5.12unaffected
  • 5.15.224 to ≤ 5.15.*unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.112 to ≤ 6.12.*unaffected
  • 6.18.54 to ≤ 6.18.*unaffected
  • 7.2.8 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References