Skip to main content

Linux Kernel EUVDEUVD-2026-86910

| CVE-2026-98080 MEDIUM
Operation on a Resource after Expiration or Release (CWE-672)
2026-09-25 Linux GHSA-m4cg-769c-m465
Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local access to run btrfs ioctls
  2. Delivery
    Enable quota and create snapshots
  3. Exploit
    Trigger balance/relocation (btrfs_balance ioctl)
  4. Execution
    Stale reloc-root ref hits freed extent
  5. Impact
    Delayed-ref insert fails, filesystem flipped read-only

Vulnerability Assessment

Weakness
CWE
CWE-672
ASVS 5.0
V15 - Secure Coding and Architecture Operation on resource after expiration or release
Exploitation Conditions

Requires (1) local access with the ability to invoke btrfs administrative ioctls (balance/relocation typically needs CAP_SYS_ADMIN), (2) a btrfs filesystem created or mounted with quota/qgroups enabled (-O quota) - a non-default option, and (3) relocation of a block group coinciding with snapshot creation so that qgroup_account_snapshot() force-creates a reloc root. These are strong limiting factors: no remote vector, no unauthenticated path, quota must be explicitly enabled, and the trigger is a privileged maintenance operation (balance) rather than attacker-supplied input. Impact is confined to availability (filesystem flipped read-only); there is no confidentiality or integrity effect.
Impact

All signals point to a LOW real-world priority despite the Medium (5.5) CVSS. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms this is a local, availability-only flaw with no confidentiality or integrity impact - the worst outcome is the btrfs filesystem being flipped read-only (fs RO) and a kernel WARNING, not code execution or data disclosure. EPSS reinforces this: 0.17% probability at the 5th percentile, i.e. near-zero expected exploitation. It is NOT on CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation. CWE-672 (operation on an expired/released resource) matches the described cause - a stale tree reference to a freed metadata extent during qgroup_account_snapshot(). Note a tag conflict: the input Tags label this 'Buffer Overflow', which contradicts both CWE-672 and the description (a reloc-root/qgroup accounting lifecycle bug, not a memory overflow); treat the 'Buffer Overflow' tag as mislabeled. The one caveat for defenders is that this is effectively a self-inflicted denial of service triggered by an administrator running balance on a quota-enabled volume, not an attacker-driven remote threat.
Exploit ScenarioDerived

A local user with the privilege to run btrfs maintenance operations enables quota (-O quota) on a btrfs filesystem and triggers a balance/relocation while snapshots are being created. During qgroup_account_snapshot() a reloc root is force-created, leaving a dangling reference to an already-freed metadata extent; the resulting delayed-ref failure throws a kernel WARNING and flips the filesystem read-only, denying service. No public exploit code is identified at time of analysis, and the condition is primarily reached by normal administrative activity rather than a crafted attack.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 06, 2026

In the Linux kernel's Btrfs filesystem, running a block-group balance/relocation on a filesystem that has quota groups enabled can force creation of a relocation root while qgroup_account_snapshot() is committing a pending snapshot, leaving a stale metadata tree reference whose extent item has already been dropped. When delayed refs are processed the kernel hits lookup_inline_extent_backref() with a WARNING and fails the ref insertion with -117 (EUCLEAN), aborting the transaction and flipping the affected Btrfs filesystem read-only; recovery requires unmount and repair/mount, making this strictly an availability issue (no confidentiality or integrity impact). The defect is local-only: the assessed vector is AV:L/AC:H/PR:L/UI:N with high attack complexity, and the assessed risk is LOW despite the Medium 5.5 CVSS base score, because it requires (a) local access able to issue Btrfs administrative ioctls - balance/relocation normally needs CAP_SYS_ADMIN - (b) a filesystem explicitly created or mounted with quota/qgroups enabled, a non-default option, and (c) tight timing between relocation and snapshot creation. EPSS is 0.17% (5th percentile), there is no KEV entry, and no public exploit code was identified at time of analysis; vendor-released patches exist in stable 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2.

RemediationAI

Apply the vendor-released kernel patch: upgrade to Linux 6.12.111, 6.18.53, 7.2.7 or 7.3-rc2 (or later stable releases containing the backports). The specific fix commits are published at https://git.kernel.org/stable/c/c4c78768d1a8ceb713693cc5524acbe984c31f3c, https://git.kernel.org/stable/c/203cbfb4fba590bd9b08bd36fa6d05b5d28923bf, https://git.kernel.org/stable/c/b5d5ab5a715001dd937c920ef8c5688fd4999ba1 and https://git.kernel.org/stable/c/cacf35832292997018837e484283f95a9301ebf5, with additional upstream references at https://git.kernel.org/stable/c/21bd77c132f18dc21c6fcdf417310d1adcf7448b, https://git.kernel.org/stable/c/7caaae233a55e167063f4cfa3385b1a04c8bbecb, https://git.kernel.org/stable/c/7ce02d52548b672795511c2cac8da6ec79ac8877 and https://git.kernel.org/stable/c/d0284d974be46a0a06068f930c84039d540ae8ed; coordinate with your distribution for backported kernel packages and reboot into the fixed kernel, since Btrfs is in-tree and cannot be swapped without a reboot. Where patching is delayed, the most effective compensating control is to disable quota accounting on affected filesystems (btrfs quota disable <mountpoint>), which removes the qgroup path that triggers the forced reloc root - the trade-off is loss of qgroup space accounting and any snapshot-size limits or quotas built on it. A second control is to avoid running balance/relocation (btrfs balance start) on qgroup-enabled filesystems, and specifically to avoid overlapping a balance with snapshot creation, since the failure requires those operations to coincide; this is an operational restriction that defers rather than fixes the bug and may conflict with capacity-rebalancing needs on degraded or nearly full volumes. Restricting who can issue Btrfs administrative ioctls (balance requires CAP_SYS_ADMIN; keep untrusted or unprivileged users off the filesystem and out of namespaces where they could reach it) reduces the trigger surface but is not a substitute for patching, and the assessed prerequisites already require low-privileged local access. Note that when the bug fires the filesystem is flipped read-only and requires unmount plus a btrfs check/repair cycle, so plan for downtime and verified backups before triggering maintenance; there is no KEV entry and no public exploit code identified, so emergency prioritization is not indicated - treat this as a low-priority, routine kernel update.

Affected VersionsENISA

Linux 204bfcda824428b3a298eae8e87875bbd435a3c1
Linux patch: 0
Linux 4.17
Linux 4d31778aa2fa342f5f92ca4025b293a1729161d1 <b5d5ab5a715001dd937c920ef8c5688fd4999ba1
Linux 4d31778aa2fa342f5f92ca4025b293a1729161d1 <c4c78768d1a8ceb713693cc5524acbe984c31f3c
Linux 4.16.13 <4.17
Linux patch: 6.18.53
Linux 1f586802bb18892d2a6eb7d31d7fed78946d21a1
Linux 4.14.45 <4.15
Linux patch: 7.2.7
Linux 4d31778aa2fa342f5f92ca4025b293a1729161d1 <203cbfb4fba590bd9b08bd36fa6d05b5d28923bf
Linux patch: 6.12.111
Linux 4d31778aa2fa342f5f92ca4025b293a1729161d1 <cacf35832292997018837e484283f95a9301ebf5
Linux patch: 7.3-rc2

Affected Packages

euvd linux fix: 4.15, 4.17

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Btrfs tracks ownership of every extent through reference (backref) records, including METADATA_ITEM tree-block backrefs pointing at the owning root objectid. When a snapshot is committed with quotas enabled, qgroup_account_snapshot() previously forced creation of a relocation root so that the qgroup accounting could proceed; that forced reloc root interacts badly with a balance/relocate_block_group() operation that is concurrently walking and rewriting the same block group. The race causes a tree block's metadata extent to be freed while a backref in a subsequently processed delayed ref still targets it, so __btrfs_run_delayed_refs() -> __btrfs_inc_extent_ref() -> insert_inline_extent_backref() -> lookup_inline_extent_backref() warns and then fails with "extent item not found for insert" and "failed to run delayed ref ... -117" (EUCLEAN). The CVE is classified CWE-672 (operation on a resource after expiration or release), which matches the observed symptom: a reference is used against an extent that has been released/relocated away. The upstream fix stops qgroup_account_snapshot() from forcing the reloc root creation, removing the ordering hazard between qgroup accounting and relocation. Affected code is the Btrfs module in the Linux kernel (CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) on kernels that implement qgroup-aware snapshot accounting with the forced reloc root behavior; the regression lineage is the 4.16/4.17 era with later reintroductions, and the EUVD affected-version data lists fix commits c4c78768d1a8ceb713693cc5524acbe984c31f3c, 203cbfb4fba590bd9b08bd36fa6d05b5d28923bf, b5d5ab5a715001dd937c920ef8c5688fd4999ba1, cacf35832292997018837e484283f95a9301ebf5 and the NVD-listed commits 21bd77c132f18dc21c6fcdf417310d1adcf7448b, 7caaae233a55e167063f4cfa3385b1a04c8bbecb, 7ce02d52548b672795511c2cac8da6ec79ac8877 and d0284d974be46a0a06068f930c84039d540ae8ed. Note the third-party tag "Buffer Overflow" does not reflect the actual mechanism, which is extent-reference accounting corruption leading to a transaction abort, not a memory-safety overflow.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.7 MEDIUM

Local-only trigger via btrfs balance (AV:L, PR:L); race/'high chance' timing and required non-default quota config raise complexity to AC:H; impact is availability-only (A:H, C:N/I:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 7.0 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Oct 06, 2026 - 17:07 NVD
5.5 (MEDIUM)
Patch available
Sep 25, 2026 - 11:02 EUVD
CVE Published
Sep 25, 2026 - 10:24 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 25, 2026 - 10:24 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

btrfs: do not force reloc root creation during qgroup_account_snapshot()

[BUG] When running btrfs/252 with quota enabled through MKFS_OPTIONS="-O quota", it has a high chance to trigger the following kernel warning and flips the fs RO:

BTRFS info (device dm-2): relocating block group 30408704 flags metadata|dup ------------[ cut here ]------------ WARNING: fs/btrfs/extent-tree.c:879 at lookup_inline_extent_backref+0x74b/0x960 [btrfs], CPU#4: btrfs/2173 CPU: 4 UID: 0 PID: 2173 Comm: btrfs Not tainted 7.2.0-rc6-custom+ #457 PREEMPT(full) 3adc6528fb66f7a55fe1095385818e742f200aab Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:lookup_inline_extent_backref+0x74b/0x960 [btrfs] Call Trace: <TASK> insert_inline_extent_backref+0x7c/0x160 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] __btrfs_inc_extent_ref+0xa9/0x270 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] __btrfs_run_delayed_refs+0x4af/0x11c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] btrfs_run_delayed_refs+0x9d/0xf0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] create_pending_snapshot+0x39d/0xf00 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] create_pending_snapshots+0x9b/0xc0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] btrfs_commit_transaction+0x280/0xeb0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] prepare_to_relocate+0x147/0x200 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] relocate_block_group+0x6b/0x5e0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] btrfs_relocate_block_group+0x92c/0x2380 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] btrfs_relocate_chunk+0x3f/0x1a0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] btrfs_balance+0xa2c/0x19c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] btrfs_ioctl+0x2839/0x2d30 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72] __x64_sys_ioctl+0x416/0x9a0 do_syscall_64+0xe1/0x790 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> ---[ end trace 0000000000000000 ]--- BTRFS info (device dm-2): leaf 4593991680 gen 233 total ptrs 175 free space 5953 owner 2 BTRFS info (device dm-2): refs 3 lock_owner 2173 current 2173 item 0 key (166772736 METADATA_ITEM 1) itemoff 16250 itemsize 33 extent refs 1 gen 222 flags 2 ref#0: tree block backref root 266 [ Skip the tree dump ] item 174 key (263225344 METADATA_ITEM 0) itemoff 10328 itemsize 33 extent refs 1 gen 162 flags 258 ref#0: tree block backref root 267 BTRFS error (device dm-2): extent item not found for insert, bytenr 179847168 num_bytes 16384 parent 4594335744 root_objectid 273 owner 0 offset 0 BTRFS error (device dm-2): failed to run delayed ref for logical 179847168 num_bytes 16384 type 182 action 1 ref_mod 1: -117

[CAUSE] The above error is showing that there is a tree reference to a metadata extent that is no longer there.

With "ref_verify" mount option (requires CONFIG_BTRFS_DEBUG), there is some extra debug output:

BTRFS error (device dm-2): dumping block entry [180961280 16384], num_refs 0, metadata 1, from disk 0 BTRFS error (device dm-2): root entry 256, num_refs 18446744073709551615 BTRFS error (device dm-2): root entry 273, num_refs 18446744073709551615 BTRFS error (device dm-2): Ref action 3, root 273, ref_root 273, parent 0, owner 0, offset 0, num_refs 1 btrfs_force_cow_block+0x129/0x7d0 [btrfs] btrfs_cow_block+0x10a/0x250 [btrfs] btrfs_search_slot+0x5eb/0xf40 [btrfs] btrfs_insert_empty_items+0x3a/0x70 [btrfs] insert_with_overflow+0x53/0x130 [btrfs] btrfs_insert_dir_item+0x125/0x290 [btrfs] btrfs_add_link+0xaa/0x410 [btrfs] btrfs_rename+0x5ea/0xcd0 [btrfs] btrfs_rename2+0x28/0x60 [btrfs] vfs_rename+0x5b2/0xe10 filename_renameat2+0x244/0x430 __x64_sys_rename+0x48/0x70 do_syscall_64+0xe1/0x790 entry_SYSCALL_64_after_hwframe+0x4b/0x53

---truncated---

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel btrfs is deployed across a huge fraction of Linux systems
Data Quality
4 sources
Confidence: Medium
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Same weakness CWE-672 – Operation on a Resource after Expiration or Release

View all
CVE-2020-11027 HIGH POC
8.1
CVE-2025-69415 HIGH POC
7.1
CVE-2019-20022 MEDIUM POC
6.5
CVE-2020-24030 CRITICAL
9.8
CVE-2020-12043 CRITICAL
9.8
CVE-2022-45292 MEDIUM POC
5.3
CVE-2026-43585 CRITICAL
9.2
CVE-2013-10075 CRITICAL
9.1

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-98080 REF https://git.kernel.org/stable/c/203cbfb4fba590bd9b08bd36fa6d05b5d28923bf REF https://git.kernel.org/stable/c/21bd77c132f18dc21c6fcdf417310d1adcf7448b REF https://git.kernel.org/stable/c/7caaae233a55e167063f4cfa3385b1a04c8bbecb REF https://git.kernel.org/stable/c/7ce02d52548b672795511c2cac8da6ec79ac8877 REF https://git.kernel.org/stable/c/b5d5ab5a715001dd937c920ef8c5688fd4999ba1 REF https://git.kernel.org/stable/c/c4c78768d1a8ceb713693cc5524acbe984c31f3c REF https://git.kernel.org/stable/c/cacf35832292997018837e484283f95a9301ebf5 REF https://git.kernel.org/stable/c/d0284d974be46a0a06068f930c84039d540ae8ed

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy