CVE-2026-98244: btrfs: clear free space tree creation state on rebuild failure
In the Linux kernel, the following vulnerability has been resolved:
btrfs: clear free space tree creation state on rebuild failure
btrfsrebuildfreespacetree() sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag.
The transaction restart failure path can leave the flag set on a live filesystem, causing delayed reference processing to be skipped. Clear it on all free space tree rebuild failure paths. Keep BTRFSFSFREESPACETREEUNTRUSTED set, since a failed rebuild leaves the free space tree untrusted. Callers must fall back to extent-tree caching.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Clear BTRFS_FS_CREATING_FREE_SPACE_TREE on all free space tree rebuild failure paths, while keeping BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED set because a failed rebuild leaves the free space tree untrusted.
Linux kernel BTRFS free space tree rebuild BTRFS_FS_CREATING_FREE_SPACE_TREE = cleared
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel with Btrfs filesystems are relevant when a free space tree rebuild is attempted and fails. The issue affects a live filesystem when failure paths leave the free space tree creation state set.
What conditions are needed to trigger the faulty state?
A free space tree rebuild must begin, set BTRFS_FS_CREATING_FREE_SPACE_TREE, and then encounter an error on one of the rebuild failure paths, including a transaction restart failure. The provided information does not identify a remote attack vector or specific user action that causes those failures.
What happens after a failed rebuild on an affected kernel?
Delayed reference processing can be skipped because the filesystem remains marked as creating the free space tree. The failed rebuild also leaves the free space tree untrusted, requiring callers to fall back to extent-tree caching.
How can the problem be mitigated if an update cannot be applied immediately?
The provided information identifies extent-tree caching as the required fallback when the free space tree is untrusted. It does not provide operational steps for forcing that fallback or clearing the stale creation-state flag on an already affected filesystem.