CVE-2026-98090

A flaw was found in the Linux kernel's Btrfs file system. A local user could exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system. During device initialization, if setup fails, the error-handling path releases the new device without restoring active device pointers back to the original device. Subsequent operations attempting to display device information then access the freed memory, triggering a kernel crash.

A use-after-free condition can occur after a failed Btrfs sprout operation because latest_dev and possibly s_bdev may continue to reference the new device after that device has been removed and released. A later call to btrfs_show_devname() can dereference the stale device pointer and cause a kernel crash. For the CVSS the PR:L value is used for the paranoid score because a reduced-capability service account or container root may have delegated access to Btrfs administration and the relevant block device without having unrestricted host root access. The attack is local and requires a failed sprout setup followed by access to the path that obtains the active device name. It is not directly network reachable. Impact is at least a local denial of service via kernel crash. Reuse of the freed allocation may permit limited confidentiality or integrity impact in a worst case interpretation, but the visible path does not establish an arbitrary write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.