CVE-2026-98081: btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: finish active block group cleanup if callzonefinish() fails

dozonefinish() clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish() then fails it returned early, leaving the now inactive block group on fsinfo->zoneactivebgs, leaking its reference, the BTRFSFSNEEDZONEFINISH waiters are never woken, and as its allocoffset equals the zone capacity btrfszonefinishonebg() keeps selecting it, spinning btrfszonedactivateonebg().

Fall through to the cleanup on failure too and return the error, but keep the block group read-only as its zones are left inconsistent.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:24 AM
Data Sourced
via MITRE·10:24 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

The issue affects Linux kernel systems using Btrfs zoned mode. The failure path involves zone-finishing operations and active block-group cleanup.

2

What happens if the zone-finish operation fails?

A failed call_zone_finish() can leave an inactive block group on the active-block-group list, leak its reference, and prevent BTRFS_FS_NEED_ZONE_FINISH waiters from being woken. Subsequent processing can repeatedly select the same block group and spin in btrfs_zoned_activate_one_bg().

3

What is the mitigation if the fix cannot be applied immediately?

The provided data does not identify a configuration workaround. The corrected behavior cleans up the block group even after failure while retaining it as read-only because its zones may be inconsistent.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203