CVE-2026-98090

Analyzed Analyzed - Analysis Complete

Btrfs Active Device Pointer Corruption on Sprout Failure

Publication date: 2026-09-25

Last updated on: 2026-10-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfs_init_new_device() switches latest_dev and possibly s_bdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the subsequent sprout setup fails, the error path releases the new device without switching those pointers back. btrfs_show_devname() can then dereference the freed latest_dev and crash. Restore the active device pointers to the latest seed device before removing and releasing the failed sprout device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-23

Generated

2026-11-08

AI Q&A

2026-09-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-98090

EUVD

EUVD-2026-86920

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.2.7 (exc)
linux	linux_kernel	7.3
linux	linux_kernel	From 6.13 (inc) to 6.18.53 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.111 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.158 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.189 (exc)
linux	linux_kernel	From 5.13 (inc) to 5.15.222 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the Btrfs filesystem. It occurs when a new device is added to a Btrfs filesystem but fails during setup. The system incorrectly keeps pointers to the failed device, which can later cause a crash when trying to access filesystem information.

Detection Guidance

This vulnerability is specific to the Linux kernel's btrfs filesystem and does not have network-based detection methods. To detect it, check kernel logs for crashes related to btrfs_show_devname() or device pointer issues after a failed btrfs sprout operation. Use commands like dmesg | grep -i btrfs or journalctl -k | grep -i btrfs to review kernel logs.

Impact Analysis

If exploited, this could lead to system crashes when accessing Btrfs filesystems, potentially causing data loss or denial of service. Users running systems with Btrfs and removable storage may be affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other common standards and regulations. It is a Linux kernel issue related to the btrfs filesystem that could cause system crashes due to dereferencing freed memory. Compliance impacts would only occur if the crash leads to data corruption or unavailability, which is not specified in the provided context.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this vulnerability. Avoid using btrfs sprout operations until the update is applied. If you cannot update immediately, consider temporarily disabling btrfs or using alternative filesystems until the patch is installed.

Hi! I’m here to help you understand CVE-2026-98090. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...