CVE-2026-98082 (GCVE-0-2026-98082)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:24 – Updated: 2026-09-25 10:24
VLAI
Title
btrfs: fix the possible bioc_list memory leak during error
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioc_list memory leak during error There are two possible ways to leak bioc memory on btrfs_ordered_extent::bioc_list: - An error occurred for btrfs_insert_one_raid_extent() Then the function btrfs_insert_raid_extent() immediately return without freeing any bioc in the bioc_list. - An ordered extent hit an IO error In that case the ordered extent will have BTRFS_ORDERED_IOERR set, and skip the call on btrfs_insert_raid_extent() completely. Fix the problem by: - Introduce a new helper, btrfs_cleanup_ordered_bioc_list() Which will remove all bioc from the bioc_list, and release the bioc. - Call the above helper for btrfs_insert_raid_extent() So that the cleanup helper is always called no matter what. - Call the above helper for btrfs_finish_one_ordered() This is called just before the final release on the ordered extent. This was reported by Sashiko when reviewing another patch.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 02c372e1f016e5113217597ab37b399c4e407477 , < 83f0c973cffb184d019390ffdb5d31de5c85bc61 (git)
Affected: 02c372e1f016e5113217597ab37b399c4e407477 , < 1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0 (git)
Affected: 02c372e1f016e5113217597ab37b399c4e407477 , < bb4da45766d16503821f167054db76b735d89e94 (git)
Affected: 02c372e1f016e5113217597ab37b399c4e407477 , < afbe73778338e6d1ac8c4486fbdf33f0cc1f2624 (git)
Affected: ab69bf6f8970c09d3735c25094e9471d54365282 (git)
Affected: 6.6.130 , < 6.7 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c",
            "fs/btrfs/raid-stripe-tree.c",
            "fs/btrfs/raid-stripe-tree.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83f0c973cffb184d019390ffdb5d31de5c85bc61",
              "status": "affected",
              "version": "02c372e1f016e5113217597ab37b399c4e407477",
              "versionType": "git"
            },
            {
              "lessThan": "1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0",
              "status": "affected",
              "version": "02c372e1f016e5113217597ab37b399c4e407477",
              "versionType": "git"
            },
            {
              "lessThan": "bb4da45766d16503821f167054db76b735d89e94",
              "status": "affected",
              "version": "02c372e1f016e5113217597ab37b399c4e407477",
              "versionType": "git"
            },
            {
              "lessThan": "afbe73778338e6d1ac8c4486fbdf33f0cc1f2624",
              "status": "affected",
              "version": "02c372e1f016e5113217597ab37b399c4e407477",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ab69bf6f8970c09d3735c25094e9471d54365282",
              "versionType": "git"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c",
            "fs/btrfs/raid-stripe-tree.c",
            "fs/btrfs/raid-stripe-tree.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.130",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix the possible bioc_list memory leak during error\n\nThere are two possible ways to leak bioc memory on\nbtrfs_ordered_extent::bioc_list:\n\n- An error occurred for btrfs_insert_one_raid_extent()\n  Then the function btrfs_insert_raid_extent() immediately return\n  without freeing any bioc in the bioc_list.\n\n- An ordered extent hit an IO error\n  In that case the ordered extent will have BTRFS_ORDERED_IOERR set, and\n  skip the call on btrfs_insert_raid_extent() completely.\n\nFix the problem by:\n\n- Introduce a new helper, btrfs_cleanup_ordered_bioc_list()\n  Which will remove all bioc from the bioc_list, and release the bioc.\n\n- Call the above helper for btrfs_insert_raid_extent()\n  So that the cleanup helper is always called no matter what.\n\n- Call the above helper for btrfs_finish_one_ordered()\n  This is called just before the final release on the ordered extent.\n\nThis was reported by Sashiko when reviewing another patch."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T10:24:18.685Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/83f0c973cffb184d019390ffdb5d31de5c85bc61"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb4da45766d16503821f167054db76b735d89e94"
        },
        {
          "url": "https://git.kernel.org/stable/c/afbe73778338e6d1ac8c4486fbdf33f0cc1f2624"
        }
      ],
      "title": "btrfs: fix the possible bioc_list memory leak during error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98082",
    "datePublished": "2026-09-25T10:24:18.685Z",
    "dateReserved": "2026-09-25T10:19:56.075Z",
    "dateUpdated": "2026-09-25T10:24:18.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/inode.c",
                  "fs/btrfs/raid-stripe-tree.c",
                  "fs/btrfs/raid-stripe-tree.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "83f0c973cffb184d019390ffdb5d31de5c85bc61",
                    "status": "affected",
                    "version": "02c372e1f016e5113217597ab37b399c4e407477",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0",
                    "status": "affected",
                    "version": "02c372e1f016e5113217597ab37b399c4e407477",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bb4da45766d16503821f167054db76b735d89e94",
                    "status": "affected",
                    "version": "02c372e1f016e5113217597ab37b399c4e407477",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "afbe73778338e6d1ac8c4486fbdf33f0cc1f2624",
                    "status": "affected",
                    "version": "02c372e1f016e5113217597ab37b399c4e407477",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "ab69bf6f8970c09d3735c25094e9471d54365282",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "affected",
                    "version": "6.6.130",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/inode.c",
                  "fs/btrfs/raid-stripe-tree.c",
                  "fs/btrfs/raid-stripe-tree.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix the possible bioc_list memory leak during error\n\nThere are two possible ways to leak bioc memory on\nbtrfs_ordered_extent::bioc_list:\n\n- An error occurred for btrfs_insert_one_raid_extent()\n  Then the function btrfs_insert_raid_extent() immediately return\n  without freeing any bioc in the bioc_list.\n\n- An ordered extent hit an IO error\n  In that case the ordered extent will have BTRFS_ORDERED_IOERR set, and\n  skip the call on btrfs_insert_raid_extent() completely.\n\nFix the problem by:\n\n- Introduce a new helper, btrfs_cleanup_ordered_bioc_list()\n  Which will remove all bioc from the bioc_list, and release the bioc.\n\n- Call the above helper for btrfs_insert_raid_extent()\n  So that the cleanup helper is always called no matter what.\n\n- Call the above helper for btrfs_finish_one_ordered()\n  This is called just before the final release on the ordered extent.\n\nThis was reported by Sashiko when reviewing another patch."
          }
        ],
        "id": "CVE-2026-98082",
        "lastModified": "2026-09-25T11:17:37.730",
        "metrics": {},
        "published": "2026-09-25T11:17:37.730",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/83f0c973cffb184d019390ffdb5d31de5c85bc61"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/afbe73778338e6d1ac8c4486fbdf33f0cc1f2624"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bb4da45766d16503821f167054db76b735d89e94"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.