CVE-2026-98959 (GCVE-0-2026-98959)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:19 – Updated: 2026-10-24 14:09
VLAI
Title
btrfs: fix xattr replace when multiple xattrs are packed in the same item
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs_dir_item item that packs multiple xattrs and then we replace the value of one of them (with the setxattr(2) family of syscalls) with another value of a different size, we end up not having a fully initialized btrfs_dir_item, resulting in a corruption that the tree checker will detect at extent buffer writeback time. This is because in btrfs_setxattr() when we find a btrfs_dir_item with multiple xattrs (due to the crc32c hash of their name being the same) we delete one of the xattr items (btrfs_dir_item) and then insert a new one, but the deletion and insertion results in shifting existing data in the leaf and therefore when the new value of a xattr has a different size, the new btrfs_dir_item is placed in a leaf section that was not initialized and we only copy the value's data and set the value's length in the new btrfs_dir_item, without setting the name, the name's length, the key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and transaction ID. The following script reproduces the issue: $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi mkfs.btrfs -f $DEV mount $DEV $MNT touch $MNT/testfile # Add two xattrs that, on btrfs, have the same hash (crc32c) for their # name and therefore are packed into the same btrfs_dir_item. setfattr -n user.foobar -v 123 $MNT/testfile setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile # Verify the xattrs are present. echo "xattrs before:" getfattr --absolute-names --dump $MNT/testfile # Now replace the value of the foobar xattr with a significantly larger # value. setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile # Check the xattrs have the expected values. echo "xattrs after:" getfattr --absolute-names --dump $MNT/testfile umount $MNT Running it: $ ./test.sh (...) xattrs before: # file: /mnt/sdi/testfile user.WvG1c1Td="qwerty" user.foobar="123" xattrs after: # file: /mnt/sdi/testfile user.WvG1c1Td="qwerty" So the "user.foobar" xattr is missing and there was a transaction abort when unmounting the fs with the following traces in dmesg: $ dmesg [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964 [869800.159293] ------------[ cut here ]------------ [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179 [869800.168961] Modules linked in: btrfs dm_thin_pool (...) [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G W 7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full) [869800.193726] Tainted: [W]=WARN [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs] [869800.198985] Code: 48 8b 7b 18 (...) [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246 [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000 [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0 [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069 [869800.229097] FS: 00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000 [869800.231137] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0 [869800.233783] Call Trace: [869800.234330] <TASK> [869800.234791] read_extent_buffer+0x4d/0x100 [btrfs] [869800.235898] btrfs_listxattr+0x199/0x240 [btrfs] [869800.236912] vfs_listxattr+0x51/0 ---truncated---
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6653 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 , < 7a53bb4668b319fc6c8a3ce2c21635125c7d2712 (git)
Affected: 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 , < 5877d7138cc4359d26fd7b010eedfd1b3162348f (git)
Affected: 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 , < a97114b9b00ed3d05156f3b2ddbf797296260389 (git)
Affected: 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 , < c1803697a60f22743aa28ad522f805e92d45e3f0 (git)
Affected: 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 , < 858bee1c77857aabcc2327cd32dd8266332de332 (git)
Affected: 43f2e3615d181a7028ab797114c5960977669b2a (git)
Affected: a873146ce4fb025c0b5c1322af5a6bad042f5363 (git)
Affected: 02590fd855d1690568b2fa439c942e933221b57a (git)
Affected: 55e97f654cbbbef70f9714f0e113604dd931e360 (git)
Affected: 3.10.83 , < 3.11 (semver)
Affected: 3.12.45 , < 3.13 (semver)
Affected: 3.14.47 , < 3.15 (semver)
Affected: 3.18.19 , < 3.19 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 6.6.160 , ≤ 6.6.* (semver)
Unaffected: 6.12.113 , ≤ 6.12.* (semver)
Unaffected: 6.18.57 , ≤ 6.18.* (semver)
Unaffected: 7.2.11 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7a53bb4668b319fc6c8a3ce2c21635125c7d2712",
              "status": "affected",
              "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
              "versionType": "git"
            },
            {
              "lessThan": "5877d7138cc4359d26fd7b010eedfd1b3162348f",
              "status": "affected",
              "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
              "versionType": "git"
            },
            {
              "lessThan": "a97114b9b00ed3d05156f3b2ddbf797296260389",
              "status": "affected",
              "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
              "versionType": "git"
            },
            {
              "lessThan": "c1803697a60f22743aa28ad522f805e92d45e3f0",
              "status": "affected",
              "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
              "versionType": "git"
            },
            {
              "lessThan": "858bee1c77857aabcc2327cd32dd8266332de332",
              "status": "affected",
              "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "43f2e3615d181a7028ab797114c5960977669b2a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a873146ce4fb025c0b5c1322af5a6bad042f5363",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "02590fd855d1690568b2fa439c942e933221b57a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "55e97f654cbbbef70f9714f0e113604dd931e360",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.83",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.45",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.47",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.19",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.83",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.14.47",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix xattr replace when multiple xattrs are packed in the same item\n\nIf we have a btrfs_dir_item item that packs multiple xattrs and then we\nreplace the value of one of them (with the setxattr(2) family of syscalls)\nwith another value of a different size, we end up not having a fully\ninitialized btrfs_dir_item, resulting in a corruption that the tree\nchecker will detect at extent buffer writeback time.\n\nThis is because in btrfs_setxattr() when we find a btrfs_dir_item with\nmultiple xattrs (due to the crc32c hash of their name being the same)\nwe delete one of the xattr items (btrfs_dir_item) and then insert a new\none, but the deletion and insertion results in shifting existing data in\nthe leaf and therefore when the new value of a xattr has a different size,\nthe new btrfs_dir_item is placed in a leaf section that was not\ninitialized and we only copy the value\u0027s data and set the value\u0027s length\nin the new btrfs_dir_item, without setting the name, the name\u0027s length,\nthe key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and\ntransaction ID.\n\nThe following script reproduces the issue:\n\n  $ cat test.sh\n  #!/bin/bash\n\n  DEV=/dev/sdi\n  MNT=/mnt/sdi\n\n  mkfs.btrfs -f $DEV\n  mount $DEV $MNT\n\n  touch $MNT/testfile\n\n  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their\n  # name and therefore are packed into the same btrfs_dir_item.\n  setfattr -n user.foobar -v 123 $MNT/testfile\n  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile\n\n  # Verify the xattrs are present.\n  echo \"xattrs before:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  # Now replace the value of the foobar xattr with a significantly larger\n  # value.\n  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile\n\n  # Check the xattrs have the expected values.\n  echo \"xattrs after:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  umount $MNT\n\nRunning it:\n\n  $ ./test.sh\n  (...)\n  xattrs before:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n  user.foobar=\"123\"\n\n  xattrs after:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n\nSo the \"user.foobar\" xattr is missing and there was a transaction abort\nwhen unmounting the fs with the following traces in dmesg:\n\n  $ dmesg\n  [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964\n  [869800.159293] ------------[ cut here ]------------\n  [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179\n  [869800.168961] Modules linked in: btrfs dm_thin_pool (...)\n  [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G        W           7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)\n  [869800.193726] Tainted: [W]=WARN\n  [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n  [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]\n  [869800.198985] Code: 48 8b 7b 18 (...)\n  [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246\n  [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000\n  [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0\n  [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff\n  [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c\n  [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069\n  [869800.229097] FS:  00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000\n  [869800.231137] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0\n  [869800.233783] Call Trace:\n  [869800.234330]  \u003cTASK\u003e\n  [869800.234791]  read_extent_buffer+0x4d/0x100 [btrfs]\n  [869800.235898]  btrfs_listxattr+0x199/0x240 [btrfs]\n  [869800.236912]  vfs_listxattr+0x51/0\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An NFSv4.2 OP_SETXATTR carries each attacker-chosen name and value; nfsd4_decode_xattr_name() prepends user. and nfsd_setxattr() reaches the patched btrfs_setxattr(). One client can send two CRC32C-colliding names followed by a different-sized replacement.\nAC:L - btrfs_name_hash() uses unkeyed CRC32C, permitting deterministic chosen-target, non-NUL collisions; the commit also supplies a fixed collision. Sequential OP_SETXATTR operations fully control packing and replacement without a race or external precondition.\nPR:N - With an AUTH_SYS NFS export, the client merely asserts a uid; nfsd_setxattr() gates the operation with fh_verify(..., NFSD_MAY_WRITE) before __vfs_setxattr_locked(). An unauthenticated client can assert the writable file\u0027s owner uid.\nUI:N - The attacker alone can issue PUTFH, the setup and replacement OP_SETXATTR operations, and subsequent GETXATTR operations. No victim must mount attacker-supplied media, open a file, or take another action.\nS:U - The malformed btrfs_dir_item, forged xattrs, leaf disclosure, and transaction abort all affect the same host kernel and filesystem security authority; no VM, IOMMU, or other isolation boundary is crossed.\nC:H - Crafted lengths make btrfs_match_dir_item_name() parse a fake user.* dir_item embedded in the replacement value. Its chosen data_len makes btrfs_getxattr()/read_extent_buffer() copy adjacent leaf contents, including potentially inline data, which NFSv4.2 GETXATTR returns.\nI:H - The same controlled parse can embed a complete security.capability dir_item whose CRC32C matches the item key. btrfs_getxattr() can then supply attacker-chosen V2 capabilities to get_vfs_caps_from_disk(), bypassing CAP_SETFCAP and permitting root code execution.\nA:H - check_dir_item() rejects the malformed entry when btrfs_check_leaf() runs from btree_csum_one_bio(); the resulting writeback failure aborts the transaction and forces the Btrfs filesystem read-only."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:09:39.735Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7a53bb4668b319fc6c8a3ce2c21635125c7d2712"
        },
        {
          "url": "https://git.kernel.org/stable/c/5877d7138cc4359d26fd7b010eedfd1b3162348f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a97114b9b00ed3d05156f3b2ddbf797296260389"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1803697a60f22743aa28ad522f805e92d45e3f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332"
        }
      ],
      "title": "btrfs: fix xattr replace when multiple xattrs are packed in the same item",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98959",
    "datePublished": "2026-10-23T12:19:27.679Z",
    "dateReserved": "2026-09-25T10:25:14.382Z",
    "dateUpdated": "2026-10-24T14:09:39.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98959",
      "date": "2026-11-07",
      "epss": "0.00607",
      "percentile": "0.49278"
    },
    "microsoft_vex": {
      "current_release_date": "2026-11-07T01:49:45.000Z",
      "cve": "CVE-2026-98959",
      "id": "msrc_CVE-2026-98959",
      "initial_release_date": "2026-10-24T01:09:52.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: fix xattr replace when multiple xattrs are packed in the same item",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98959.json",
      "version": "6"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/xattr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7a53bb4668b319fc6c8a3ce2c21635125c7d2712",
                    "status": "affected",
                    "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5877d7138cc4359d26fd7b010eedfd1b3162348f",
                    "status": "affected",
                    "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a97114b9b00ed3d05156f3b2ddbf797296260389",
                    "status": "affected",
                    "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c1803697a60f22743aa28ad522f805e92d45e3f0",
                    "status": "affected",
                    "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "858bee1c77857aabcc2327cd32dd8266332de332",
                    "status": "affected",
                    "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "43f2e3615d181a7028ab797114c5960977669b2a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "a873146ce4fb025c0b5c1322af5a6bad042f5363",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "02590fd855d1690568b2fa439c942e933221b57a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "55e97f654cbbbef70f9714f0e113604dd931e360",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3.11",
                    "status": "affected",
                    "version": "3.10.83",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.13",
                    "status": "affected",
                    "version": "3.12.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.15",
                    "status": "affected",
                    "version": "3.14.47",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "affected",
                    "version": "3.18.19",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/xattr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.19"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix xattr replace when multiple xattrs are packed in the same item\n\nIf we have a btrfs_dir_item item that packs multiple xattrs and then we\nreplace the value of one of them (with the setxattr(2) family of syscalls)\nwith another value of a different size, we end up not having a fully\ninitialized btrfs_dir_item, resulting in a corruption that the tree\nchecker will detect at extent buffer writeback time.\n\nThis is because in btrfs_setxattr() when we find a btrfs_dir_item with\nmultiple xattrs (due to the crc32c hash of their name being the same)\nwe delete one of the xattr items (btrfs_dir_item) and then insert a new\none, but the deletion and insertion results in shifting existing data in\nthe leaf and therefore when the new value of a xattr has a different size,\nthe new btrfs_dir_item is placed in a leaf section that was not\ninitialized and we only copy the value\u0027s data and set the value\u0027s length\nin the new btrfs_dir_item, without setting the name, the name\u0027s length,\nthe key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and\ntransaction ID.\n\nThe following script reproduces the issue:\n\n  $ cat test.sh\n  #!/bin/bash\n\n  DEV=/dev/sdi\n  MNT=/mnt/sdi\n\n  mkfs.btrfs -f $DEV\n  mount $DEV $MNT\n\n  touch $MNT/testfile\n\n  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their\n  # name and therefore are packed into the same btrfs_dir_item.\n  setfattr -n user.foobar -v 123 $MNT/testfile\n  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile\n\n  # Verify the xattrs are present.\n  echo \"xattrs before:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  # Now replace the value of the foobar xattr with a significantly larger\n  # value.\n  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile\n\n  # Check the xattrs have the expected values.\n  echo \"xattrs after:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  umount $MNT\n\nRunning it:\n\n  $ ./test.sh\n  (...)\n  xattrs before:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n  user.foobar=\"123\"\n\n  xattrs after:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n\nSo the \"user.foobar\" xattr is missing and there was a transaction abort\nwhen unmounting the fs with the following traces in dmesg:\n\n  $ dmesg\n  [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964\n  [869800.159293] ------------[ cut here ]------------\n  [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179\n  [869800.168961] Modules linked in: btrfs dm_thin_pool (...)\n  [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G        W           7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)\n  [869800.193726] Tainted: [W]=WARN\n  [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n  [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]\n  [869800.198985] Code: 48 8b 7b 18 (...)\n  [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246\n  [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000\n  [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0\n  [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff\n  [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c\n  [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069\n  [869800.229097] FS:  00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000\n  [869800.231137] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0\n  [869800.233783] Call Trace:\n  [869800.234330]  \u003cTASK\u003e\n  [869800.234791]  read_extent_buffer+0x4d/0x100 [btrfs]\n  [869800.235898]  btrfs_listxattr+0x199/0x240 [btrfs]\n  [869800.236912]  vfs_listxattr+0x51/0\n---truncated---"
          }
        ],
        "id": "CVE-2026-98959",
        "lastModified": "2026-10-24T14:16:49.307",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-23T13:17:17.233",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5877d7138cc4359d26fd7b010eedfd1b3162348f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7a53bb4668b319fc6c8a3ce2c21635125c7d2712"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a97114b9b00ed3d05156f3b2ddbf797296260389"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c1803697a60f22743aa28ad522f805e92d45e3f0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-07T10:36:35+00:00",
      "cve": "CVE-2026-98959",
      "id": "CVE-2026-98959",
      "initial_release_date": "2026-10-23T00:00:00+00:00",
      "product_status:known_affected": "203",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix xattr replace when multiple xattrs are packed in the same item",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98959.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-27T17:59:08Z",
      "cve": "CVE-2026-98959",
      "id": "CVE-2026-98959",
      "initial_release_date": "2026-10-23T23:52:45Z",
      "product_status:known_affected": "158",
      "product_status:known_not_affected": "190",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98959",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-98959.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.