CVE-2026-98245

What it actually does

Use-after-free in btrfs mark_block_group_to_copy() when iterating the commit root with skip_locking=true; a concurrent transaction commit can swap and free the root, causing invalid access to freed extent buffers.

Why it matters to the business

Kernel memory corruption on Linux systems using btrfs can lead to crashes, denial of service, or potential privilege escalation, disrupting storage operations and requiring urgent patching across fleets.

How an attack unfolds

An attacker with local access triggers btrfs operations that invoke mark_block_group_to_copy() while racing a transaction commit to free the commit root, resulting in use-after-free on extent buffers.

How to fix it

Apply the upstream fix that sets path->need_commit_sem during commit root iteration in mark_block_group_to_copy(); update to a kernel containing the resolution for this use-after-free.

How to confirm the fix worked

Verify the presence of the commit semaphore protection in the btrfs code path; test by exercising concurrent transaction commits and block group marking under load; confirm no use-after-free reports in kernel logs.

Typical attack path

1. Obtain local access or code execution on a Linux host using btrfs
2. Mount or perform filesystem operations that exercise block group marking
3. Race concurrent transaction commits to trigger commit root swap and free
4. Access freed extent buffers to corrupt kernel memory or escalate privileges

How to detect it

Review kernel logs for btrfs transaction commit races or use-after-free warnings; look for suspicious patterns of block group operations coinciding with transaction activity.

What your security team should do

• Prioritize kernel updates for all systems using btrfs filesystems
• Monitor for btrfs-related kernel oops or panic reports indicating potential exploitation attempts
• Restrict untrusted local access on systems until patched