CVE-2026-98081: btrfs: zoned: finish active block group cleanup if call_zone_finish() fails
In the Linux kernel, the following vulnerability has been resolved:
btrfs: zoned: finish active block group cleanup if callzonefinish() fails
dozonefinish() clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish() then fails it returned early, leaving the now inactive block group on fsinfo->zoneactivebgs, leaking its reference, the BTRFSFSNEEDZONEFINISH waiters are never woken, and as its allocoffset equals the zone capacity btrfszonefinishonebg() keeps selecting it, spinning btrfszonedactivateonebg().
Fall through to the cleanup on failure too and return the error, but keep the block group read-only as its zones are left inconsistent.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems using Btrfs zoned mode. The failure path involves zone-finishing operations and active block-group cleanup.
What happens if the zone-finish operation fails?
A failed call_zone_finish() can leave an inactive block group on the active-block-group list, leak its reference, and prevent BTRFS_FS_NEED_ZONE_FINISH waiters from being woken. Subsequent processing can repeatedly select the same block group and spin in btrfs_zoned_activate_one_bg().
What is the mitigation if the fix cannot be applied immediately?
The provided data does not identify a configuration workaround. The corrected behavior cleans up the block group even after failure while retaining it as read-only because its zones may be inconsistent.