CVE-2026-98244: btrfs: clear free space tree creation state on rebuild failure

Published Oct 6, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

btrfs: clear free space tree creation state on rebuild failure

btrfsrebuildfreespacetree() sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag.

The transaction restart failure path can leave the flag set on a live filesystem, causing delayed reference processing to be skipped. Clear it on all free space tree rebuild failure paths. Keep BTRFSFSFREESPACETREEUNTRUSTED set, since a failed rebuild leaves the free space tree untrusted. Callers must fall back to extent-tree caching.

Affected Software

1 affected component

Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Clear BTRFS_FS_CREATING_FREE_SPACE_TREE on all free space tree rebuild failure paths so callers fall back to the extent tree.
Linux kernel Btrfs BTRFS_FS_CREATING_FREE_SPACE_TREE = cleared

Event History

Oct 6, 2026

CVE Published

via MITRE·08:45 AM

Data Sourced

via MITRE·08:45 AM

Description

Data Sourced

via NVD·09:18 AM

Description

Frequently Asked Questions

What systems are exposed to this issue?

Systems using the Linux kernel with Btrfs filesystems are relevant when a free space tree rebuild is attempted and fails. The issue affects a live filesystem when failure paths leave the free space tree creation state set.

What conditions are needed to trigger the faulty state?

A free space tree rebuild must begin, set BTRFS_FS_CREATING_FREE_SPACE_TREE, and then encounter an error on one of the rebuild failure paths, including a transaction restart failure. The provided information does not identify a remote attack vector or specific user action that causes those failures.

What happens after a failed rebuild on an affected kernel?

Delayed reference processing can be skipped because the filesystem remains marked as creating the free space tree. The failed rebuild also leaves the free space tree untrusted, requiring callers to fall back to extent-tree caching.

How can the problem be mitigated if an update cannot be applied immediately?

The provided information identifies extent-tree caching as the required fallback when the free space tree is untrusted. It does not provide operational steps for forcing that fallback or clearing the stale creation-state flag on an already affected filesystem.

CVE-2026-98244: btrfs: clear free space tree creation state on rebuild failure

Affected Software

Remediation

Event History

Frequently Asked Questions

What systems are exposed to this issue?

What conditions are needed to trigger the faulty state?

What happens after a failed rebuild on an affected kernel?

How can the problem be mitigated if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this issue?

What conditions are needed to trigger the faulty state?

What happens after a failed rebuild on an affected kernel?

How can the problem be mitigated if an update cannot be applied immediately?