Look up another CVE · open CVE-2026-98083 in the interactive tracker
CVE-2026-98083
btrfs: fix transaction use-after-free in raid stripe insertion
Published 2026-09-25 (24 days ago) by the Linux kernel CNA. Subsystem fs/btrfs. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-98083 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.7-1 | Update the kernel and reboot. Fixed in 7.2.7-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM. btrfs_finish_one_ordered(), the production caller through btrfs_insert_raid_extent(), still owns the transaction handle. It handles the error by aborting the transaction and then reaches the common exit path, which ends the transaction again. The premature end can free the handle and drop its transaction reference. Transaction cleanup can then free the transaction before the caller's second abort accesses the handle and transaction, resulting in use-after-free. Keep the abort at the failure site, but let the caller's common exit path end the transaction once, after it has finished using both objects.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/btrfs/raid-stripe-tree.c
- What this is
- BTRFS FILE SYSTEMMAINTAINERS section matched on fs/btrfs/ · linux-btrfs@vger.kernel.org · Maintained
- Kernel module
- btrfs
Check it on the machine
grep -w CONFIG_BTRFS_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w btrfsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release with an answer below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixie, forky, sid, bookworm · linux-6.12m
- ?
- not established - no Makefile entry for the affected file
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_BTRFS_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-25 (24 days ago)source
- CVSS
- 7.0 high
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.12%, higher than 1.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- fs/btrfs
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.6.130 | 6.6.158 | 089d9c45ea49 |
| 6.7 | 6.12.111 | b185bdf30313 |
| 6.7 | 6.18.53 | 2fbfd02bdfe1 |
| 6.7 | 7.2.7 | b7b94923b3b5 |
| 6.7 | 7.3 | a8813a923f9e |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached through local file writes: buffered or direct writes on a mounted btrfs raid-stripe-tree filesystem create ordered extents, and btrfs_finish_one_ordered() then calls btrfs_insert_raid_extent() -> btrfs_insert_one_raid_extent(). No remote peer supplies input that causes the failure.
- AC:HAttack complexity, high
- The bug fires only when a small, non-memcg-accounted kzalloc(GFP_NOFS) of the stripe extent fails, which needs system-wide memory exhaustion the attacker cannot reliably produce. It also needs a non-default CONFIG_BTRFS_EXPERIMENTAL kernel and an admin-created RAID_STRIPE_TREE filesystem.
- PR:LPrivileges required, low
- Once such a filesystem is mounted, any unprivileged user with write access to a file on it can drive ordered extent completion into btrfs_insert_one_raid_extent(). No capability check exists on this path.
- UI:NUser interaction, none
- The attacker only issues their own write operations to a filesystem that is already mounted; no mounting of attacker media or other victim action is needed.
- S:UScope, unchanged
- The corrupted objects are kernel btrfs_trans_handle and btrfs_transaction structures in the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- After the premature btrfs_end_transaction() frees the trans handle and drops the transaction reference, btrfs_finish_one_ordered() aborts on the freed handle and transaction. That use-after-free of slab objects could be reclaimed by attacker-sprayed data to leak kernel memory.
- I:HIntegrity impact, high
- The caller's btrfs_abort_transaction() writes to the freed handle and transaction, and its second btrfs_end_transaction() frees the handle again. This use-after-write and double free of slab objects is a memory-corruption primitive usable for control-flow hijack.
- A:HAvailability impact, high
- The double end/free of the btrfs transaction handle and use of the freed transaction reliably corrupts slab state or oopses the kernel, taking down the system and the filesystem.