Improper handling of exceptional conditions in Linux kernel - CVE-2026-98269
Published: October 7, 2026
Vulnerability identifier: #VU153751
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98269
CWE-ID: CWE-755
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause persistent filesystem inconsistencies.
The vulnerability exists due to improper handling of inode update failures in btrfs_replace_file_extents() when performing hole punching or reflinking. A local user can perform hole punching or reflinking operations that encounter an inode update failure to cause persistent filesystem inconsistencies.
Exploitation requires the transaction to be committed after the inode update failure.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98269
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d
- https://git.kernel.org/stable/c/36c68dc909845c049e0286d229bc502947239452
- https://git.kernel.org/stable/c/834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6
- https://git.kernel.org/stable/c/9588850bfa75c78ce73c2f6f72544d19d2e9beb6
- https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f