In the Linux kernel, the following vulnerability has been resolved:

btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()

mark_block_group_to_copy() iterates over the commit root with
skip_locking=true. A concurrent transaction commit can swap and free
the commit root during iteration, causing use-after-free when
accessing extent buffers.

Fix it by using path->need_commit_sem to protect the commit root search.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
78ce9fc269af6e69c1399ab910ba6bc81c934f67 affected < 8e2007b263ea250251ec3021a0a197da990ee1a8
78ce9fc269af6e69c1399ab910ba6bc81c934f67 affected < 709f6a5e986535005110c6c69b322f63631cb200
78ce9fc269af6e69c1399ab910ba6bc81c934f67 affected < c32490c6d3f3a9f2d177d57c7eb8bbc347561d08
78ce9fc269af6e69c1399ab910ba6bc81c934f67 affected < 0594e3423f4ba3137c734371169491f9a98e9af4
Linux Linux affected
Version Status Constraints
5.12 affected —
0 unaffected < 5.12
6.12.112 unaffected ≤ 6.12.*
6.18.54 unaffected ≤ 6.18.*
7.2.8 unaffected ≤ 7.2.*
7.3-rc4 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0594e3423f4ba3137c734371169491f9a98e9af4 cve-icon cve-icon
https://git.kernel.org/stable/c/709f6a5e986535005110c6c69b322f63631cb200 cve-icon cve-icon
https://git.kernel.org/stable/c/8e2007b263ea250251ec3021a0a197da990ee1a8 cve-icon cve-icon
https://git.kernel.org/stable/c/c32490c6d3f3a9f2d177d57c7eb8bbc347561d08 cve-icon cve-icon
History

Tue, 06 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() mark_block_group_to_copy() iterates over the commit root with skip_locking=true. A concurrent transaction commit can swap and free the commit root during iteration, causing use-after-free when accessing extent buffers. Fix it by using path->need_commit_sem to protect the commit root search.
Title btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-06T08:45:14.758Z

Reserved: 2026-09-25T10:25:14.330Z

Link: CVE-2026-98245

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-06T09:18:12.643

Modified: 2026-10-06T09:18:12.643

Link: CVE-2026-98245

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T12:45:17Z

Weaknesses