CVE-2026-98090
Description
A flaw was found in the Linux kernel's Btrfs file system. A local user could exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system. During device initialization, if setup fails, the error-handling path releases the new device without restoring active device pointers back to the original device. Subsequent operations attempting to display device information then access the freed memory, triggering a kernel crash.
Statement
A use-after-free condition can occur after a failed Btrfs sprout operation because latest_dev and possibly s_bdev may continue to reference the new device after that device has been removed and released. A later call to btrfs_show_devname() can dereference the stale device pointer and cause a kernel crash. For the CVSS the PR:L value is used for the paranoid score because a reduced-capability service account or container root may have delegated access to Btrfs administration and the relevant block device without having unrestricted host root access. The attack is local and requires a failed sprout setup followed by access to the path that obtains the active device name. It is not directly network reachable. Impact is at least a local denial of service via kernel crash. Reuse of the freed allocation may permit limited confidentiality or integrity impact in a worst case interpretation, but the visible path does not establish an arbitrary write primitive.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
