CVE-2026-98090
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfs_init_new_device() switches latest_dev and possibly s_bdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the subsequent sprout setup fails, the error path releases the new device without switching those pointers back. btrfs_show_devname() can then dereference the freed latest_dev and crash. Restore the active device pointers to the latest seed device before removing and releasing the failed sprout device.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-25 11:17:38.697000
Last modified
2026-10-23 19:00:22.020000
View original CVE JSON
{
"id": "CVE-2026-98090",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-25T11:17:38.697",
"lastModified": "2026-10-23T19:00:22.020",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: restore active device pointers after failed sprout\n\nbtrfs_init_new_device() switches latest_dev and possibly s_bdev from the\nseed device to the new sprout device before creating the first writable\nchunks.\n\nIf chunk creation or the subsequent sprout setup fails, the error path\nreleases the new device without switching those pointers back.\nbtrfs_show_devname() can then dereference the freed latest_dev and crash.\n\nRestore the active device pointers to the latest seed device before\nremoving and releasing the failed sprout device."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/btrfs/volumes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "a6e7e218a4d6488d56727a7d9aee1b7e78c0c485",
"lessThan": "46863a9f93186e620c70584f91c8d5d95da83eff",
"versionType": "git",
"status": "affected"
},
{
"version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
"lessThan": "49179f13c04735c55fd0f43b03696c015b067137",
"versionType": "git",
"status": "affected"
},
{
"version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
"lessThan": "0a0ee38ad6324ac1603079bb785f784191576bd5",
"versionType": "git",
"status": "affected"
},
{
"version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
"lessThan": "2ee5c4bc11007c51f63f0c1be5d3f07f2b404ff7",
"versionType": "git",
"status": "affected"
},
{
"version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
"lessThan": "e127ac29a52134d0f4cba39d38e4b375deb3d1aa",
"versionType": "git",
"status": "affected"
},
{
"version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
"lessThan": "b79b4b29003690acfade8241998fc0104ef9c84c",
"versionType": "git",
"status": "affected"
},
{
"version": "b7cb29e666fe79dda5dbe5f57fb7c92413bf161c",
"lessThan": "e0b54613aabeb8e9da597f23b90c6a03d0981986",
"versionType": "git",
"status": "affected"
},
{
"version": "5.15.11",
"lessThan": "5.15.222",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/btrfs/volumes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.16",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.16",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.222",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.189",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.158",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.111",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.53",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.7",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.13",
"versionEndExcluding": "5.15.222",
"matchCriteriaId": "9B5FB2D7-5BE0-4BD3-B914-D8083487AB9E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.189",
"matchCriteriaId": "FE14E0F2-AE30-4319-B6E7-5D8B82530FD6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.158",
"matchCriteriaId": "575D98F4-AE0C-4D1F-91BC-CD1C75F0FED0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.111",
"matchCriteriaId": "47BC31C9-3D9E-4B96-B5F8-291D6AD55D81"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.53",
"matchCriteriaId": "7561AABB-6D5A-4324-BC66-C6C6B012AFD8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "7.2.7",
"matchCriteriaId": "19917B2D-B4B2-4416-A482-9C7C4929A921"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "11E35E1B-5DB4-4AB9-9706-CD73B799EADF"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/0a0ee38ad6324ac1603079bb785f784191576bd5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2ee5c4bc11007c51f63f0c1be5d3f07f2b404ff7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/46863a9f93186e620c70584f91c8d5d95da83eff",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/49179f13c04735c55fd0f43b03696c015b067137",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b79b4b29003690acfade8241998fc0104ef9c84c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/e0b54613aabeb8e9da597f23b90c6a03d0981986",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/e127ac29a52134d0f4cba39d38e4b375deb3d1aa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}