CVE-2026-98091: btrfs: detach failed sprout device from transaction update list

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-10-23
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction update list When creating the first metadata chunk for a sprout filesystem, create_chunk() adds the new device to the transaction dev_update_list through device->post_commit_list. If the subsequent system chunk creation fails, btrfs_init_new_device() aborts the transaction and releases the device while post_commit_list is still linked. This triggers a warning in btrfs_free_device() and leaves the transaction list referencing freed memory. Detach the device while holding chunk_mutex before releasing it.

Affected products

Linux kernel: from 5.2 before 5.10.271; from 5.11 before 5.15.222; from 5.16 before 6.1.189; from 6.2 before 6.6.158; from 6.7 before 6.12.111; from 6.13 before 6.18.53 — fixed in 5.10.271, 5.15.222, 6.1.189, 6.12.111, 6.18.53, 6.6.158

How to fix

Upgrade to a fixed version: Linux kernel 5.10.271, 5.15.222, 6.1.189, 6.12.111. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98091 or the next vulnerability affects your stack