CVE-2026-98083: btrfs: fix transaction use-after-free in raid stripe insertion
btrfs: fix transaction use-after-free in raid stripe insertion
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Under what conditions can this bug be triggered?
The failure path requires allocation of a RAID stripe extent to fail in Btrfs. The affected path is reached while finishing ordered work through btrfs_finish_one_ordered(), after btrfs_insert_one_raid_extent() returns -ENOMEM.
What is the practical impact of the faulty error handling?
A failed RAID stripe extent allocation can cause the transaction handle to be ended prematurely. Later cleanup may free the transaction before the caller performs its second abort, causing that abort to access freed transaction-handle and transaction objects.
Is an out-of-memory condition involved in exploitation or detection?
Yes. The described trigger is btrfs_insert_one_raid_extent() returning -ENOMEM because RAID stripe extent allocation failed. Systems experiencing allocation failures during this Btrfs ordered-work path are the relevant population for investigation.
What code behavior distinguishes the corrected implementation?
The failure site still aborts the transaction, but does not end it before returning. The caller's common exit path ends the transaction once, only after it has finished using the transaction handle and transaction objects.