CVE-2026-98269

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on failure to update inode for hole punching and reflinking If we fail to update the inode we error out without aborting the transaction, which can result in a persistent inconsistency if after the failure the transaction is committed, as we have dropped file extent items from a range and either punched a hole or insert a new file extent item for that range (for reflinks). So add the missing transaction abort.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98269

EUVD

EUVD-2026-93197

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	2aaa66558172b017f36bf38ae69372813dedee9d
Linux	Linux	2aaa66558172b017f36bf38ae69372813dedee9d
Linux	Linux	2aaa66558172b017f36bf38ae69372813dedee9d
Linux	Linux	2aaa66558172b017f36bf38ae69372813dedee9d
Linux	Linux	2aaa66558172b017f36bf38ae69372813dedee9d
Linux	Linux	3.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel occurs during file operations like hole punching or reflinking. If the system fails to update an inode during these operations, it does not properly abort the transaction. This can lead to persistent inconsistencies where file extent items are incorrectly modified or removed, potentially causing data corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's btrfs filesystem and requires kernel-level inspection. Detection involves checking kernel logs for btrfs-related errors or inconsistencies. Use commands like 'dmesg | grep btrfs' or 'journalctl -k | grep btrfs' to search for errors. If you suspect filesystem corruption, run 'btrfs check /dev/sdX' on affected volumes.

Impact Analysis

This vulnerability could lead to data corruption or loss on systems using the btrfs filesystem. If exploited, it may cause files to appear corrupted or missing after operations like hole punching or reflinking. Users might experience system instability or unexpected behavior in file operations.

Compliance Impact

This vulnerability could lead to persistent data inconsistencies in the Btrfs filesystem, potentially causing unauthorized data access or corruption. Such issues may violate compliance requirements under GDPR (data integrity) or HIPAA (data integrity and availability), depending on the affected system's use case.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this CVE. If you cannot update immediately, avoid operations that trigger the vulnerable code paths, such as hole punching or reflinking on btrfs filesystems. Monitor filesystem integrity and back up critical data.

Hi! I’m here to help you understand CVE-2026-98269. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70