CVE-2026-98090 (GCVE-0-2026-98090)
Vulnerability from cvelistv5
Published
2026-09-25 10:24
Modified
2026-10-19 09:13
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfs_init_new_device() switches latest_dev and possibly s_bdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the subsequent sprout setup fails, the error path releases the new device without switching those pointers back. btrfs_show_devname() can then dereference the freed latest_dev and crash. Restore the active device pointers to the latest seed device before removing and releasing the failed sprout device.
References
Impacted products
Vendor Product Version
Linux Linux Version: a6e7e218a4d6488d56727a7d9aee1b7e78c0c485
Version: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c
Version: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c
Version: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c
Version: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c
Version: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c
Version: b7cb29e666fe79dda5dbe5f57fb7c92413bf161c
Version: 5.15.11   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/volumes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "46863a9f93186e620c70584f91c8d5d95da83eff",
              "status": "affected",
              "version": "a6e7e218a4d6488d56727a7d9aee1b7e78c0c485",
              "versionType": "git"
            },
            {
              "lessThan": "49179f13c04735c55fd0f43b03696c015b067137",
              "status": "affected",
              "version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
              "versionType": "git"
            },
            {
              "lessThan": "0a0ee38ad6324ac1603079bb785f784191576bd5",
              "status": "affected",
              "version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
              "versionType": "git"
            },
            {
              "lessThan": "2ee5c4bc11007c51f63f0c1be5d3f07f2b404ff7",
              "status": "affected",
              "version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
              "versionType": "git"
            },
            {
              "lessThan": "e127ac29a52134d0f4cba39d38e4b375deb3d1aa",
              "status": "affected",
              "version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
              "versionType": "git"
            },
            {
              "lessThan": "b79b4b29003690acfade8241998fc0104ef9c84c",
              "status": "affected",
              "version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
              "versionType": "git"
            },
            {
              "lessThan": "e0b54613aabeb8e9da597f23b90c6a03d0981986",
              "status": "affected",
              "version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.222",
              "status": "affected",
              "version": "5.15.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/volumes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.15.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: restore active device pointers after failed sprout\n\nbtrfs_init_new_device() switches latest_dev and possibly s_bdev from the\nseed device to the new sprout device before creating the first writable\nchunks.\n\nIf chunk creation or the subsequent sprout setup fails, the error path\nreleases the new device without switching those pointers back.\nbtrfs_show_devname() can then dereference the freed latest_dev and crash.\n\nRestore the active device pointers to the latest seed device before\nremoving and releasing the failed sprout device."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:13:42.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/46863a9f93186e620c70584f91c8d5d95da83eff"
        },
        {
          "url": "https://git.kernel.org/stable/c/49179f13c04735c55fd0f43b03696c015b067137"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a0ee38ad6324ac1603079bb785f784191576bd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ee5c4bc11007c51f63f0c1be5d3f07f2b404ff7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e127ac29a52134d0f4cba39d38e4b375deb3d1aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/b79b4b29003690acfade8241998fc0104ef9c84c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0b54613aabeb8e9da597f23b90c6a03d0981986"
        }
      ],
      "title": "btrfs: restore active device pointers after failed sprout",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98090",
    "datePublished": "2026-09-25T10:24:23.474Z",
    "dateReserved": "2026-09-25T10:19:56.075Z",
    "dateUpdated": "2026-10-19T09:13:42.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.