Linux Kernel EUVD-2026-57050

The btrfs B-tree filesystem subsystem in the Linux kernel manages extent maps - internal kernel data structures (struct extent_map) that track file data placement on disk. The function btrfs_drop_extent_map_range() splits an existing extent map when a sub-range is dropped, initializing the new split maps from a local 'flags' copy of the original map's flags. Commit f86f7a75e2fb, which changed how compression type is encoded via extent map flags, inadvertently altered the EXTENT_FLAG_LOGGING clearing to target em->flags directly rather than the local 'flags' copy used to seed splits. This means any extent map currently being logged - and bearing EXTENT_FLAG_LOGGING - will have that flag inherited by both split halves. The flag is never subsequently cleared on the splits. When the kernel's extent map shrinker reclaims memory by freeing such a split map while it still resides on the inode's modified_extents linked list, the WARN_ON(!list_empty(&em->list)) assertion in btrfs_free_extent_map() fires, and the freed memory is subsequently accessed (use-after-free). Affected CPE: cpe:2.3:a:linux:linux. No formal CWE is assigned, but the root cause maps to CWE-416 (Use After Free) with a flag-lifetime management regression as the precipitating defect.