Use-after-free in Linux kernel - CVE-2026-98245

Vulnerability details

The vulnerability allows a local user to trigger access to freed memory in the Linux kernel.

The vulnerability exists due to use-after-free in mark_block_group_to_copy() when iterating over the Btrfs commit root without locking. A local user can trigger iteration concurrently with a transaction commit that swaps and frees the commit root to trigger access to freed memory through extent buffers.

Affected software

How to mitigate CVE-2026-98245

External References

• https://git.kernel.org/stable/c/0594e3423f4ba3137c734371169491f9a98e9af4
• https://git.kernel.org/stable/c/709f6a5e986535005110c6c69b322f63631cb200
• https://git.kernel.org/stable/c/8e2007b263ea250251ec3021a0a197da990ee1a8
• https://git.kernel.org/stable/c/c32490c6d3f3a9f2d177d57c7eb8bbc347561d08

Related Security Bulletins

• Use-after-free in Linux kernel btrfs
• Debian update for linux