CVE-2026-98082 Overview
CVE-2026-98082 is a memory leak vulnerability in the Linux kernel's Btrfs filesystem. The flaw resides in the handling of btrfs_ordered_extent::bioc_list structures during error conditions. Two code paths fail to release allocated bioc memory: an error return from btrfs_insert_one_raid_extent() causes btrfs_insert_raid_extent() to exit without cleanup, and ordered extents flagged with BTRFS_ORDERED_IOERR skip the insertion call entirely. Repeated triggering of either path exhausts kernel memory on systems using Btrfs RAID configurations.
Critical Impact
Repeated I/O errors or RAID extent insertion failures leak kernel memory, degrading availability of Btrfs-backed Linux systems over time.
Affected Products
- Linux kernel (Btrfs filesystem subsystem)
- Distributions shipping affected stable kernels using Btrfs with RAID extent tree
- Systems with Btrfs volumes experiencing I/O errors on ordered extents
Discovery Timeline
- 2026-09-25 - CVE-2026-98082 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-98082
Vulnerability Analysis
The vulnerability affects the Btrfs RAID extent handling path in the Linux kernel. Each btrfs_ordered_extent structure maintains a bioc_list containing btrfs_io_context (bioc) entries that describe RAID stripe mappings. The code assumes btrfs_insert_raid_extent() consumes and releases every bioc on the list during normal completion.
Two error paths break this assumption. First, when btrfs_insert_one_raid_extent() returns an error, the wrapper btrfs_insert_raid_extent() returns immediately and leaves remaining entries on the list unreleased. Second, when an ordered extent encounters an I/O failure and BTRFS_ORDERED_IOERR is set, the entire call to btrfs_insert_raid_extent() is skipped, leaving the full bioc_list intact when the ordered extent is freed.
Root Cause
The root cause is missing cleanup logic on error exit paths [Memory Leak]. Ownership of bioc structures is tied to successful completion of btrfs_insert_raid_extent(), with no symmetric free routine for abnormal termination. The patch introduces a dedicated helper, btrfs_cleanup_ordered_bioc_list(), that iterates the list and releases each entry.
Attack Vector
Exploitation requires conditions that cause RAID extent insertion errors or ordered extent I/O errors on a Btrfs filesystem. A local attacker able to induce storage I/O failures, or an environment with faulty storage, can repeatedly trigger the leak. Each leaked bioc persists until reboot, enabling gradual kernel memory exhaustion and denial of service.
No synthetic exploitation code is available for this issue. Review the upstream fix in Linux Kernel Commit bb4da45 for implementation details.
Detection Methods for CVE-2026-98082
Indicators of Compromise
- Progressive growth of unaccounted kernel slab memory on hosts running Btrfs with RAID profiles
- Btrfs I/O error messages in dmesg referencing ordered extents and BTRFS_ORDERED_IOERR
- Elevated allocation counts in slab caches associated with btrfs_io_context structures
Detection Strategies
- Monitor /proc/slabinfo and /proc/meminfo for sustained growth in kernel allocations on Btrfs hosts
- Correlate Btrfs error log entries with memory pressure events to identify leak-triggering workloads
- Track kernel version inventory to identify hosts running unpatched Btrfs code paths
Monitoring Recommendations
- Alert on repeated Btrfs ordered extent I/O errors in system logs across the fleet
- Baseline kernel memory consumption on Btrfs servers and alert on anomalous slab growth
- Audit RAID storage health to reduce the frequency of I/O errors that trigger the leak path
How to Mitigate CVE-2026-98082
Immediate Actions Required
- Inventory Linux hosts running Btrfs filesystems, particularly those using RAID extent trees
- Apply the stable kernel update containing the btrfs_cleanup_ordered_bioc_list() helper
- Prioritize patching on systems with history of storage I/O errors or long uptimes
Patch Information
The upstream fix introduces btrfs_cleanup_ordered_bioc_list() and invokes it from both btrfs_insert_raid_extent() and btrfs_finish_one_ordered(), ensuring bioc entries are released on every exit path. Apply the fix from the following stable kernel commits: Linux Kernel Commit 1b4d4e8, Linux Kernel Commit 83f0c97, Linux Kernel Commit afbe737, and Linux Kernel Commit bb4da45.
Workarounds
- Reboot affected hosts periodically to reclaim leaked kernel memory until patches are deployed
- Avoid Btrfs RAID profiles on hosts with known unreliable storage until the kernel is patched
- Replace or repair storage devices generating ordered extent I/O errors to minimize leak triggers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.