CVE-2026-98081
Received Received - Intake

Btrfs Zoned Mode Block Group Cleanup Failure

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if call_zone_finish() fails do_zone_finish() clears BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE before finishing the zones. If call_zone_finish() then fails it returned early, leaving the now inactive block group on fs_info->zone_active_bgs, leaking its reference, the BTRFS_FS_NEED_ZONE_FINISH waiters are never woken, and as its alloc_offset equals the zone capacity btrfs_zone_finish_one_bg() keeps selecting it, spinning btrfs_zoned_activate_one_bg(). Fall through to the cleanup on failure too and return the error, but keep the block group read-only as its zones are left inconsistent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98081
EUVD
EUVD-2026-86911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's BTRFS filesystem for zoned devices occurs when finishing active block group cleanup fails. The issue arises because do_zone_finish() clears a flag indicating the block group is active before completing zone operations. If a subsequent step fails, the system returns early without proper cleanup, leaving the block group in an inconsistent state. This causes references to leak, waiters to remain unnotified, and the system to repeatedly attempt to activate the same inactive block group, leading to a spin loop.

Detection Guidance

This vulnerability is specific to the Linux kernel's BTRFS filesystem with zoned mode enabled. Detection requires checking kernel logs for BTRFS-related errors or warnings, particularly involving zone finishing failures. Use commands like dmesg | grep -i btrfs or journalctl -k | grep -i btrfs to inspect kernel logs for anomalies.

Impact Analysis

This vulnerability can cause system hangs or excessive CPU usage due to the spin loop in btrfs_zone_finish_one_bg(). It may lead to filesystem instability, data corruption, or denial of service as the system becomes unresponsive while repeatedly trying to recover from the failed cleanup. Users may experience system freezes or crashes during filesystem operations on zoned storage devices.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling BTRFS zoned mode if not required, or switch to a non-zoned filesystem configuration to avoid exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98081. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart