SB20260928116 - Use-after-free in Linux kernel btrfs

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98083)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in Btrfs RAID stripe insertion transaction handling when allocation of a RAID stripe extent fails. A local user can invoke the affected RAID stripe insertion path during this error condition to compromise confidentiality, integrity, and availability.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2fbfd02bdfe12b20bd3cc7a3190fb32e3f7072f5
• https://git.kernel.org/stable/c/a8813a923f9e43f788b357fb55c35f7f6ed6f98c
• https://git.kernel.org/stable/c/b185bdf30313e213fa1c887fe22fc3d513c061d9
• https://git.kernel.org/stable/c/b7b94923b3b5774d85a2a7c8d6eb9e3e0ef66685