Riskcovery

CVE-2026-98269

btrfs: abort transaction on failure to update inode for hole punching and reflinking

State
Published
Severity
Not scored
Published
Oct 6, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: abort transaction on failure to update inode for hole punching and reflinking

If we fail to update the inode we error out without aborting the transaction, which can result in a persistent inconsistency if after the failure the transaction is committed, as we have dropped file extent items from a range and either punched a hole or insert a new file extent item for that range (for reflinks).

So add the missing transaction abort.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 2aaa66558172b017f36bf38ae69372813dedee9d to before 2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067dAffected
  • 2aaa66558172b017f36bf38ae69372813dedee9d to before 834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6Affected
  • 2aaa66558172b017f36bf38ae69372813dedee9d to before 9588850bfa75c78ce73c2f6f72544d19d2e9beb6Affected
  • 2aaa66558172b017f36bf38ae69372813dedee9d to before 36c68dc909845c049e0286d229bc502947239452Affected
  • 2aaa66558172b017f36bf38ae69372813dedee9d to before 97fcd34aa9fd73cefe3120ac9a82ca9d7763922fAffected
LinuxLinux
  • 3.7Affected
  • before 3.7Not affected
  • 6.6.158 through 6.6.*Not affected
  • 6.12.112 through 6.12.*Not affected
  • 6.18.54 through 6.18.*Not affected
  • 7.2.8 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.