CVE-2026-98091: btrfs: detach failed sprout device from transaction update list

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

btrfs: detach failed sprout device from transaction update list

When creating the first metadata chunk for a sprout filesystem, createchunk() adds the new device to the transaction devupdatelist through device->postcommitlist.

If the subsequent system chunk creation fails, btrfsinitnewdevice() aborts the transaction and releases the device while postcommitlist is still linked. This triggers a warning in btrfsfreedevice() and leaves the transaction list referencing freed memory.

Detach the device while holding chunkmutex before releasing it.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    For btrfs sprout filesystem chunk creation, detach the failed device from the transaction dev_update_list while holding chunk_mutex, before releasing the device, so device->post_commit_list cannot reference freed memory.

Event History

Sep 25, 2026
CVE Published
via MITRE·10:24 AM
Data Sourced
via MITRE·10:24 AM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems using the Linux kernel with Btrfs sprout filesystem creation are exposed when creation of the first metadata chunk proceeds far enough to add the new device to the transaction update list and subsequent system chunk creation fails.

2

What condition triggers the vulnerable state?

The issue is triggered by a failure during subsequent system chunk creation after create_chunk() has linked the new device through device->post_commit_list. Transaction abort then releases the device without first removing that list entry, leaving a transaction list reference to freed memory.

3

How can administrators identify that the issue has occurred?

The described failure triggers a warning in btrfs_free_device(). It also leaves the transaction update list referencing freed memory after the failed device initialization path.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203