CVE-2026-98269btrfs: abort transaction on failure to update inode for hole punching and reflinking
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on failure to update inode for hole punching and reflinking If we fail to update the inode we error out without aborting the transaction, which can result in a persistent inconsistency if after the failure the transaction is committed, as we have dropped file extent items from a range and either punched a hole or insert a new file extent item for that range (for reflinks). So add the missing transaction abort.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2aaa66558172b017f36bf38ae69372813dedee9d before 2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d; from 2aaa66558172b017f36bf38ae69372813dedee9d before 834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6; from 2aaa66558172b017f36bf38ae69372813dedee9d before 9588850bfa75c78ce73c2f6f72544d19d2e9beb6; from 2aaa66558172b017f36bf38ae69372813dedee9d before 36c68dc909845c049e0286d229bc502947239452; from 2aaa66558172b017f36bf38ae69372813dedee9d before 97fcd34aa9fd73cefe3120ac9a82ca9d7763922f | CNA record |
References
- https://git.kernel.org/stable/c/2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d
- https://git.kernel.org/stable/c/834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6
- https://git.kernel.org/stable/c/9588850bfa75c78ce73c2f6f72544d19d2e9beb6
- https://git.kernel.org/stable/c/36c68dc909845c049e0286d229bc502947239452
- https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.