CVE-2026-98244

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98244", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.330Z", "datePublished": "2026-10-06T08:45:14.120Z", "dateUpdated": "2026-10-19T09:16:15.841Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:16:15.841Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: clear free space tree creation state on rebuild failure\n\nbtrfs_rebuild_free_space_tree() sets BTRFS_FS_CREATING_FREE_SPACE_TREE\nbefore rebuilding the free space tree. Several error paths return\nwithout clearing this flag.\n\nThe transaction restart failure path can leave the flag set on a live\nfilesystem, causing delayed reference processing to be skipped. Clear it\non all free space tree rebuild failure paths. Keep\nBTRFS_FS_FREE_SPACE_TREE_UNTRUSTED set, since a failed rebuild leaves\nthe free space tree untrusted. Callers must fall back to extent-tree\ncaching."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/free-space-tree.c"], "versions": [{"version": "882af9f13e830c0a4ef696bb72cd5998a5067a93", "lessThan": "a32bedab8ece9d1f90a1476a5b486a1804dc78ba", "status": "affected", "versionType": "git"}, {"version": "882af9f13e830c0a4ef696bb72cd5998a5067a93", "lessThan": "b1df2997d0cd2be7bef7b4ab64ccfd1019dedc81", "status": "affected", "versionType": "git"}, {"version": "882af9f13e830c0a4ef696bb72cd5998a5067a93", "lessThan": "3565893cc72cdf6b795cf6a33e7ff9605322334d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/free-space-tree.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a32bedab8ece9d1f90a1476a5b486a1804dc78ba"}, {"url": "https://git.kernel.org/stable/c/b1df2997d0cd2be7bef7b4ab64ccfd1019dedc81"}, {"url": "https://git.kernel.org/stable/c/3565893cc72cdf6b795cf6a33e7ff9605322334d"}], "title": "btrfs: clear free space tree creation state on rebuild failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/btrfs/free-space-tree.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a32bedab8ece9d1f90a1476a5b486a1804dc78ba", "status": "affected", "version": "882af9f13e830c0a4ef696bb72cd5998a5067a93", "versionType": "git"}, {"lessThan": "b1df2997d0cd2be7bef7b4ab64ccfd1019dedc81", "status": "affected", "version": "882af9f13e830c0a4ef696bb72cd5998a5067a93", "versionType": "git"}, {"lessThan": "3565893cc72cdf6b795cf6a33e7ff9605322334d", "status": "affected", "version": "882af9f13e830c0a4ef696bb72cd5998a5067a93", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/btrfs/free-space-tree.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: clear free space tree creation state on rebuild failure\n\nbtrfs_rebuild_free_space_tree() sets BTRFS_FS_CREATING_FREE_SPACE_TREE\nbefore rebuilding the free space tree. Several error paths return\nwithout clearing this flag.\n\nThe transaction restart failure path can leave the flag set on a live\nfilesystem, causing delayed reference processing to be skipped. Clear it\non all free space tree rebuild failure paths. Keep\nBTRFS_FS_FREE_SPACE_TREE_UNTRUSTED set, since a failed rebuild leaves\nthe free space tree untrusted. Callers must fall back to extent-tree\ncaching."}], "id": "CVE-2026-98244", "lastModified": "2026-10-19T10:18:25.303", "metrics": {}, "published": "2026-10-06T09:18:12.510", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3565893cc72cdf6b795cf6a33e7ff9605322334d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a32bedab8ece9d1f90a1476a5b486a1804dc78ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b1df2997d0cd2be7bef7b4ab64ccfd1019dedc81"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: btrfs: clear free space tree creation state on rebuild failure", "id": "2546520", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546520"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-459", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbtrfs: clear free space tree creation state on rebuild failure\nbtrfs_rebuild_free_space_tree() sets BTRFS_FS_CREATING_FREE_SPACE_TREE\nbefore rebuilding the free space tree. Several error paths return\nwithout clearing this flag.\nThe transaction restart failure path can leave the flag set on a live\nfilesystem, causing delayed reference processing to be skipped. Clear it\non all free space tree rebuild failure paths. Keep\nBTRFS_FS_FREE_SPACE_TREE_UNTRUSTED set, since a failed rebuild leaves\nthe free space tree untrusted. Callers must fall back to extent-tree\ncaching.", "A flaw was found in the Linux kernel's Btrfs file system. When an error occurs while rebuilding the free space tree, the kernel fails to properly reset an internal state flag on failure paths. A local user could exploit this condition during filesystem operations, leaving the flag set on an active file system and causing delayed reference processing to be skipped. This issue can result in filesystem metadata inconsistency, data corruption, or a Denial of Service (DoS)."], "name": "CVE-2026-98244", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98244\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98244\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98244.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[882af9f13e830c0a4ef696bb72cd5998a5067a93,a32bedab8ece9d1f90a1476a5b486a1804dc78ba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[882af9f13e830c0a4ef696bb72cd5998a5067a93,b1df2997d0cd2be7bef7b4ab64ccfd1019dedc81)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[882af9f13e830c0a4ef696bb72cd5998a5067a93,3565893cc72cdf6b795cf6a33e7ff9605322334d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T13:00:15.830343+00:00", "updated": "2026-10-11T19:15:18.403351+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}