CVE-2026-98091: btrfs: detach failed sprout device from transaction update list
In the Linux kernel, the following vulnerability has been resolved:
btrfs: detach failed sprout device from transaction update list
When creating the first metadata chunk for a sprout filesystem, createchunk() adds the new device to the transaction devupdatelist through device->postcommitlist.
If the subsequent system chunk creation fails, btrfsinitnewdevice() aborts the transaction and releases the device while postcommitlist is still linked. This triggers a warning in btrfsfreedevice() and leaves the transaction list referencing freed memory.
Detach the device while holding chunkmutex before releasing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For btrfs sprout filesystem chunk creation, detach the failed device from the transaction dev_update_list while holding chunk_mutex, before releasing the device, so device->post_commit_list cannot reference freed memory.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel with Btrfs sprout filesystem creation are exposed when creation of the first metadata chunk proceeds far enough to add the new device to the transaction update list and subsequent system chunk creation fails.
What condition triggers the vulnerable state?
The issue is triggered by a failure during subsequent system chunk creation after create_chunk() has linked the new device through device->post_commit_list. Transaction abort then releases the device without first removing that list entry, leaving a transaction list reference to freed memory.
How can administrators identify that the issue has occurred?
The described failure triggers a warning in btrfs_free_device(). It also leaves the transaction update list referencing freed memory after the failed device initialization path.