CVE-2026-98081

btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 21, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

do_zone_finish() clears BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE before finishing the zones. If call_zone_finish() then fails it returned early, leaving the now inactive block group on fs_info->zone_active_bgs, leaking its reference, the BTRFS_FS_NEED_ZONE_FINISH waiters are never woken, and as its alloc_offset equals the zone capacity btrfs_zone_finish_one_bg() keeps selecting it, spinning btrfs_zoned_activate_one_bg().

Fall through to the cleanup on failure too and return the error, but keep the block group read-only as its zones are left inconsistent.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d70cbdda75da3f258118a558c087157e073229fb to before 433d52b196a689b18dcfadc7cf6c784f0e5cc7c9Affected d70cbdda75da3f258118a558c087157e073229fb to before 36b9cdab44848f25879ca625275c92b007f84653Affected d70cbdda75da3f258118a558c087157e073229fb to before 40370f02a1ca3760f8925ffcbe76eb4d91ea758dAffected d70cbdda75da3f258118a558c087157e073229fb to before e1b168a53174b385e3548bfbd079513b22ac240cAffected d70cbdda75da3f258118a558c087157e073229fb to before a18a6b93a2843b9d103d3456bbd4b3f90282a379Affected
LinuxLinux	5.19Affected before 5.19Not affected 6.6.160 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

d70cbdda75da3f258118a558c087157e073229fb to before 433d52b196a689b18dcfadc7cf6c784f0e5cc7c9Affected
d70cbdda75da3f258118a558c087157e073229fb to before 36b9cdab44848f25879ca625275c92b007f84653Affected
d70cbdda75da3f258118a558c087157e073229fb to before 40370f02a1ca3760f8925ffcbe76eb4d91ea758dAffected
d70cbdda75da3f258118a558c087157e073229fb to before e1b168a53174b385e3548bfbd079513b22ac240cAffected
d70cbdda75da3f258118a558c087157e073229fb to before a18a6b93a2843b9d103d3456bbd4b3f90282a379Affected

LinuxLinux

5.19Affected
before 5.19Not affected
6.6.160 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.