Linux Kernel CVE-2026-98082

Requires a mounted btrfs filesystem using the RAID stripe tree feature, plus the ability to trigger btrfs error paths: either a failing btrfs_insert_one_raid_extent() call or an ordered extent hitting an I/O error (BTRFS_ORDERED_IOERR set), which is when the bioc_list is leaked. Limiting factors: local access only (AV:L), low-privilege but still authenticated access (PR:L) sufficient to drive btrfs writes, the RAID stripe tree is a relatively new non-default btrfs configuration, and exploitation depends on repeatedly inducing error conditions an attacker cannot reliably force - so meaningful impact requires sustained, abnormal error rates rather than a single operation.

This is a genuinely low-priority issue despite warranting a patch. Every risk signal points the same direction: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) describes a local, authenticated-only flaw with no confidentiality or integrity impact - only availability. EPSS is 0.17% (5th percentile), the CVE is NOT on CISA KEV, and no public POC is identified, so there is no evidence of exploitation interest. The underlying defect (CWE-401, kernel memory leak of btrfs_ordered_extent::bioc_list entries) is a reliability bug, not a classic weaponizable primitive: there is no memory-corruption or privilege-escalation path described, only gradual kernel memory consumption. One signal to scrutinize: the upstream CVSS sets AC:L, but the leak only occurs on error paths (a failed btrfs_insert_one_raid_extent() or an ordered extent hitting BTRFS_ORDERED_IOERR), which an attacker cannot reliably force on demand - realistic attack complexity is higher than AC:L implies. The input Tag 'Information Disclosure' conflicts with the CVSS vector (C:N) and the CWE (memory leak / availability); this is a mislabel, not an information-disclosure bug. Net: a valid stability fix to roll in with normal kernel updates, not an emergency.

A local user with the ability to perform writes on a btrfs filesystem using the RAID stripe tree feature repeatedly induces I/O errors or raid-extent insertion failures, each of which leaks bioc structures from the ordered extent's bioc_list. Over many iterations unreclaimable kernel memory accumulates, degrading or eventually denying service on the host. No public exploit code is identified, and the bug requires sustained error conditions rather than a single crafted input.