UBUNTU-CVE-2026-98081: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if callzonefinish() fails dozonefinish() clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish() then fails it returned early, leaving the now inactive block group on fsinfo->zoneactivebgs, leaking its reference, the BTRFSFSNEEDZONEFINISH waiters are never woken, and as its allocoffset equals the zone capacity btrfszonefinishonebg() keeps selecting it, spinning btrfszonedactivateonebg(). Fall through to the cleanup on failure too and return the error, but keep the block group read-only as its zones are left inconsistent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In btrfs zoned block-group finishing, if call_zone_finish() fails, fall through to the cleanup path and return the error; keep the block group read-only because its zones may be left inconsistent.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects the listed Ubuntu Linux kernel package variants: linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop. The vulnerable code is in Btrfs zoned filesystem handling.
What conditions are needed to trigger the problem?
A Btrfs zoned filesystem must encounter a failure from call_zone_finish() while finishing an active block group. This leaves the block group in the active-block-group list after its active flag has been cleared.
What is the operational impact if it is triggered?
The affected block group retains a reference, waiters for BTRFS_FS_NEED_ZONE_FINISH are not awakened, and btrfs_zoned_activate_one_bg() can repeatedly select the same block group and spin. The block group is also left read-only because its zones may be inconsistent.