Cloudanix VulnDB

CVE-2026-98907

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in the Linux kernel's handling of certain file system operations could let local actions interfere with disk reads, risking crashes or data issues on affected machines.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in btrfs sb_write_pointer() allows concurrent BLKBSZSET ioctl to alter block size during read_cache_page_gfp() superblock read from page cache, resulting in use of inconsistent block size metadata.

Why it matters to the business

Systems running btrfs may experience kernel instability, unexpected crashes, or filesystem metadata inconsistencies during normal block device operations, increasing downtime risk on servers and workstations using the filesystem.

How an attack unfolds

A local attacker triggers concurrent block size change ioctls while btrfs performs superblock reads via sb_write_pointer, racing the page cache read against the size update to corrupt in-memory structures or cause invalid memory access.

How to fix it

Update to a Linux kernel containing the commit that serializes read_cache_page_gfp with the mapping invalidate lock around sb_write_pointer; rebuild and reboot affected systems.

How to confirm the fix worked

Inspect kernel source for presence of invalidate lock acquisition around read_cache_page_gfp in btrfs sb_write_pointer; verify running kernel version includes the fix and test block size change operations under load.

Typical attack path

  1. Obtain local unprivileged access on Linux system using btrfs
  2. Issue BLKBSZSET ioctl to change block device size
  3. Simultaneously trigger btrfs superblock write or mount operations that call sb_write_pointer
  4. Exploit resulting inconsistent block size state to induce kernel panic or data corruption

How to detect it

Review kernel logs for btrfs superblock read errors or page cache anomalies coinciding with block device size change events; examine audit logs for sequences of BLKBSZSET ioctls followed by btrfs mount or sync activity.

What your security team should do

  • Prioritize kernel upgrade on all btrfs hosts within maintenance windows due to recent publication
  • Monitor for btrfs-related kernel oops or panics in system logs
  • Restrict unprivileged access to block device ioctls via LSM or capabilities where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 ("btrfs: sync read disk super and set block size"). Take the mapping invalidate lock around read_cache_page_gfp() to serialize the read against block size changes.

Affected packages

Ecosystem Package Introduced Fixed