CVE-2026-68442

Received Received - Intake

Btrfs Use-After-Free in Extent Map Handling

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When btrfs_drop_extent_map_range() splits an extent map, the new split maps inherit the original map's flags through a local 'flags' variable. Commit f86f7a75e2fb ("btrfs: use the flags of an extent map to identify the compression type") changed the EXTENT_FLAG_LOGGING clearing to operate on em->flags instead of that local 'flags' copy, so a split of an extent map that is currently being logged wrongly inherits EXTENT_FLAG_LOGGING. The flag is then never cleared on the split, and when it is freed while still on the inode's modified_extents list (for example by the extent map shrinker) it trips the WARN_ON(!list_empty(&em->list)) in btrfs_free_extent_map() and leads to a use-after-free. Clear EXTENT_FLAG_LOGGING from the local 'flags' copy used for the splits and only clear EXTENT_FLAG_PINNED from em->flags, restoring the behaviour prior to f86f7a75e2fb.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-17

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-68442

EUVD

EUVD-2026-57050

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the btrfs file system where splitting extent maps incorrectly inherits the EXTENT_FLAG_LOGGING flag. This leads to a use-after-free condition when the extent map is freed while still on the inode's modified_extents list, triggering a kernel warning and potential system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's btrfs filesystem and does not have direct network detection methods. You can check if your system is vulnerable by verifying the kernel version and whether it includes the affected btrfs code. Use uname -a to check the kernel version and grep for the specific commit in the kernel source.

Impact Analysis

This vulnerability can cause system crashes or instability due to the use-after-free condition. It may lead to data corruption or unexpected behavior in systems using the btrfs file system, potentially disrupting services or causing data loss.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level Linux kernel issue related to btrfs file system handling. Compliance impacts would depend on system configuration and usage rather than this specific bug.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. Since the issue is resolved in a specific commit, apply the latest stable kernel update or patch from your distribution. Avoid using affected kernel versions until patched.

Hi! I’m here to help you understand CVE-2026-68442. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70