SB2026081279 - Use-after-free in Linux kernel btrfs

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-68442)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and execute arbitrary code.

The vulnerability exists due to use-after-free in btrfs_drop_extent_map_range() and btrfs_free_extent_map() when splitting extent maps during logging. A local user can trigger crafted filesystem activity to cause a denial of service and execute arbitrary code.

The issue is caused by split extent maps incorrectly inheriting EXTENT_FLAG_LOGGING and later being freed while still linked on the inode's modified_extents list.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0e465c63f103a5ce6849614d6bda048d70eebec8
• https://git.kernel.org/stable/c/2a9246a424f45f33a1b8367052611ebe874868ad
• https://git.kernel.org/stable/c/5eff4d5b17fa1950e80bfd1ba43dc0699e61a644
• https://git.kernel.org/stable/c/9304713b70e7e1450e3a76e758836fe5391bfa95