CVE-2026-98082: btrfs: fix the possible bioc_list memory leak during error
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix the possible bioclist memory leak during error
There are two possible ways to leak bioc memory on btrfsorderedextent::bioclist:
- An error occurred for btrfsinsertoneraidextent() Then the function btrfsinsertraidextent() immediately return without freeing any bioc in the bioclist.
- An ordered extent hit an IO error In that case the ordered extent will have BTRFSORDEREDIOERR set, and skip the call on btrfsinsertraidextent() completely.
Fix the problem by:
- Introduce a new helper, btrfscleanuporderedbioclist() Which will remove all bioc from the bioclist, and release the bioc.
- Call the above helper for btrfsinsertraidextent() So that the cleanup helper is always called no matter what.
- Call the above helper for btrfsfinishoneordered() This is called just before the final release on the ordered extent.
This was reported by Sashiko when reviewing another patch.
Affected Software
Event History
Frequently Asked Questions
What conditions can lead to the memory leak?
The leak can occur if btrfs_insert_one_raid_extent() returns an error, causing btrfs_insert_raid_extent() to return without releasing entries in the ordered extent's bioc_list. It can also occur when an ordered extent has an I/O error and is marked BTRFS_ORDERED_IOERR, which skips btrfs_insert_raid_extent() entirely.
How can I verify that the fix is present?
Verify that the kernel includes btrfs_cleanup_ordered_bioc_list() and calls it from both btrfs_insert_raid_extent() and btrfs_finish_one_ordered(). The referenced stable commits contain the remediation.
Does the available information identify an attacker-controlled exploitation path?
No. The available information describes memory leaks triggered by internal Btrfs error and I/O-error handling paths, but does not identify an attacker-controlled input, required access level, or exploitation method.