Cloudanix VulnDB

CVE-2026-98244

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's btrfs storage code can leave the filesystem in a bad state after a failed internal repair, risking crashes or data problems on servers and devices using that storage format.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to clear BTRFS_FS_CREATING_FREE_SPACE_TREE on error paths in btrfs_rebuild_free_space_tree leaves delayed reference processing disabled on a live filesystem while preserving the untrusted-tree flag.

Why it matters to the business

Btrfs volumes may experience silent metadata corruption, unexpected transaction restarts, or kernel crashes, increasing risk of data loss and unplanned downtime on affected Linux systems.

How an attack unfolds

An attacker with local access triggers btrfs free-space-tree rebuild (via mount options or administrative commands), forces an error path, and leaves the creating flag set so that subsequent delayed-reference work is skipped, leading to inconsistent on-disk state.

How to fix it

Apply the upstream kernel patch that clears BTRFS_FS_CREATING_FREE_SPACE_TREE on every rebuild failure path. Reboot or remount affected btrfs filesystems after the update; no configuration changes are required.

How to confirm the fix worked

Confirm the fix is present by inspecting the btrfs source for the added clear operation on all error exits from btrfs_rebuild_free_space_tree, then verify the flag is cleared after an injected failure during testing.

Typical attack path

  1. Obtain local access or ability to trigger btrfs mount/rebuild operations
  2. Cause btrfs_rebuild_free_space_tree to enter an error return path
  3. Observe that BTRFS_FS_CREATING_FREE_SPACE_TREE remains set
  4. Continue normal filesystem activity so that delayed references are never processed
  5. Filesystem reaches inconsistent state resulting in crashes or corruption

How to detect it

Search kernel logs for repeated btrfs transaction or delayed-reference warnings following free-space-tree rebuild attempts; examine dmesg or journalctl for BTRFS_FS_CREATING_FREE_SPACE_TREE related messages around mount or scrub events.

What your security team should do

  • Prioritize patching Linux kernels that contain btrfs within the next maintenance window
  • Monitor upstream stable branches for the referenced commit
  • Test btrfs volumes under error-injection workloads before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfs_rebuild_free_space_tree() sets BTRFS_FS_CREATING_FREE_SPACE_TREE before rebuilding the free space tree. Several error paths return without clearing this flag. The transaction restart failure path can leave the flag set on a live filesystem, causing delayed reference processing to be skipped. Clear it on all free space tree rebuild failure paths. Keep BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED set, since a failed rebuild leaves the free space tree untrusted. Callers must fall back to extent-tree caching.

Affected packages

Ecosystem Package Introduced Fixed