CVE-2026-98082

btrfs: fix the possible bioc_list memory leak during error

MEDIUM
5.5
CVSS Score
Published: September 25, 2026 at 10:24 AM UTC
Updated: October 19, 2026 at 10:18 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioc_list memory leak during error There are two possible ways to leak bioc memory on btrfs_ordered_extent::bioc_list: - An error occurred for btrfs_insert_one_raid_extent() Then the function btrfs_insert_raid_extent() immediately return without freeing any bioc in the bioc_list. - An ordered extent hit an IO error In that case the ordered extent will have BTRFS_ORDERED_IOERR set, and skip the call on btrfs_insert_raid_extent() completely. Fix the problem by: - Introduce a new helper, btrfs_cleanup_ordered_bioc_list() Which will remove all bioc from the bioc_list, and release the bioc. - Call the above helper for btrfs_insert_raid_extent() So that the cleanup helper is always called no matter what. - Call the above helper for btrfs_finish_one_ordered() This is called just before the final release on the ordered extent. This was reported by Sashiko when reviewing another patch.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.13 ≤ v < 6.18.536.19 ≤ v < 7.2.76.6.130 ≤ v < 6.6.1586.7 ≤ v < 6.12.1112c372e1f16e5113217597ab37b399c4e4074776.6.1307.37.3 rc1ab69bf6f8970c09d3735c25094e9471d54365282
Vendor states this is fixed in 1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0 (fixed)
Vendor states this is fixed in 83f0c973cffb184d019390ffdb5d31de5c85bc61 (fixed)
Vendor states this is fixed in afbe73778338e6d1ac8c4486fbdf33f0cc1f2624 (fixed)
Vendor states this is fixed in bb4da45766d16503821f167054db76b735d89e94 (fixed)
Vendor states this is fixed in d043c43d2b4ebcd75ee7f907948ef2847306d6b2 (fixed)
Vendor states this is fixed in 6.12.111 (unaffected)
Vendor states this is fixed in 6.18.53 (unaffected)
Vendor states this is fixed in 6.6.158 (unaffected)
Vendor states this is fixed in 6.7 (unaffected)
Vendor states this is fixed in 7.2.7 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc2 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-401

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card