CVE-2026-98083

A flaw was found in the Linux kernel's Btrfs file system. An improper error-handling sequence during RAID stripe extent insertion can prematurely release transaction objects if memory allocation fails. A local user could exploit this flaw to trigger a use-after-free condition, leading to a system crash and Denial of Service (DoS) or potential memory corruption.

A transaction use-after-free can occur in the Btrfs RAID stripe insertion error path when allocation of a stripe extent fails. btrfs_insert_one_raid_extent() prematurely ends the transaction while its caller still owns and later uses the transaction handle. The first transaction end can free the handle and drop the final transaction reference, after which the caller can access freed objects while aborting or ending the transaction again. The directly supported impact is a local kernel crash and denial of service. For the CVSS the PR:L is selected because an unprivileged local user with write access to an affected Btrfs filesystem may be able to generate the required filesystem activity, although reliable triggering also depends on reaching the rare allocation failure path. The issue is not directly network reachable. AC:H reflects the need to trigger the RAID stripe insertion path while the relevant allocation fails and transaction cleanup releases the objects before their next use.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.