CVE-2026-98245

A flaw was found in the Linux kernel's Btrfs file system. A local user could exploit this vulnerability to cause a Denial of Service (DoS) or potentially escalate privileges. The issue occurs due to missing synchronization during device replacement operations, where a concurrent transaction commit can free memory while it is actively being accessed, resulting in a use-after-free condition.

A race in Btrfs zoned device replacement allows mark_block_group_to_copy() to iterate the commit root without holding the commit root semaphore. A concurrent transaction commit can replace and free that root while the search path still references its extent buffers, creating a use-after-free dereference that can crash the kernel and may expose a memory corruption path if the freed storage is reused. For the CVSS the PR:L value is used for the paranoid score because a local user may be able to generate filesystem activity and transaction commits while an administrator initiated device replacement is active, although initiating the replacement normally requires administrative privileges. The issue is not network reachable. Impact is at least a local denial of service via kernel crash and in the worst case may include confidentiality or integrity impact due to the use-after-free condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.