Use-After-Free Vulnerability in Linux Kernel Btrfs RAID Handling

CVE-2026-98083

What is CVE-2026-98083?

A use-after-free vulnerability exists in the Linux kernel, specifically within the btrfs filesystem's RAID stripe insertion routine. When the allocation of a RAID stripe extent fails, the function btrfs_insert_one_raid_extent() aborts the transaction prematurely. The issue arises in the handling of transaction references, as subsequent calls can free references before the operation complete. This flaw can potentially be exploited to access freed memory regions, leading to unstable system behavior or possible information exposure. Proper error handling measures must be implemented to mitigate this risk.

References