{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-98080", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-98080", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-09-25T10:24:17.491Z", "updatedAt": "2026-10-19T09:13:29.778Z", "importedAt": "2026-10-24T01:58:41.756Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "btrfs: do not force reloc root creation during qgroup_account_snapshot()", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not force reloc root creation during qgroup_account_snapshot()\n\n[BUG]\nWhen running btrfs/252 with quota enabled through MKFS_OPTIONS=\"-O quota\",\nit has a high chance to trigger the following kernel warning and flips\nthe fs RO:\n\n BTRFS info (device dm-2): relocating block group 30408704 flags metadata|dup\n ------------[ cut here ]------------\n WARNING: fs/btrfs/extent-tree.c:879 at lookup_inline_extent_backref+0x74b/0x960 [btrfs], CPU#4: btrfs/2173\n CPU: 4 UID: 0 PID: 2173 Comm: btrfs Not tainted 7.2.0-rc6-custom+ #457 PREEMPT(full) 3adc6528fb66f7a55fe1095385818e742f200aab\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n RIP: 0010:lookup_inline_extent_backref+0x74b/0x960 [btrfs]\n Call Trace:\n \n insert_inline_extent_backref+0x7c/0x160 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n __btrfs_inc_extent_ref+0xa9/0x270 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n __btrfs_run_delayed_refs+0x4af/0x11c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n btrfs_run_delayed_refs+0x9d/0xf0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n create_pending_snapshot+0x39d/0xf00 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n create_pending_snapshots+0x9b/0xc0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n btrfs_commit_transaction+0x280/0xeb0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n prepare_to_relocate+0x147/0x200 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n relocate_block_group+0x6b/0x5e0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n btrfs_relocate_block_group+0x92c/0x2380 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n btrfs_relocate_chunk+0x3f/0x1a0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n btrfs_balance+0xa2c/0x19c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n btrfs_ioctl+0x2839/0x2d30 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n __x64_sys_ioctl+0x416/0x9a0\n do_syscall_64+0xe1/0x790\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \n ---[ end trace 0000000000000000 ]---\n BTRFS info (device dm-2): leaf 4593991680 gen 233 total ptrs 175 free space 5953 owner 2\n BTRFS info (device dm-2): refs 3 lock_owner 2173 current 2173\n \titem 0 key (166772736 METADATA_ITEM 1) itemoff 16250 itemsize 33\n \t\textent refs 1 gen 222 flags 2\n \t\tref#0: tree block backref root 266\n [ Skip the tree dump ]\n \titem 174 key (263225344 METADATA_ITEM 0) itemoff 10328 itemsize 33\n \t\textent refs 1 gen 162 flags 258\n \t\tref#0: tree block backref root 267\n BTRFS error (device dm-2): extent item not found for insert, bytenr 179847168 num_bytes 16384 parent 4594335744 root_objectid 273 owner 0 offset 0\n BTRFS error (device dm-2): failed to run delayed ref for logical 179847168 num_bytes 16384 type 182 action 1 ref_mod 1: -117\n\n[CAUSE]\nThe above error is showing that there is a tree reference to a metadata\nextent that is no longer there.\n\nWith \"ref_verify\" mount option (requires CONFIG_BTRFS_DEBUG), there is\nsome extra debug output:\n\n BTRFS error (device dm-2): dumping block entry [180961280 16384], num_refs 0, metadata 1, from disk 0\n BTRFS error (device dm-2): root entry 256, num_refs 18446744073709551615\n BTRFS error (device dm-2): root entry 273, num_refs 18446744073709551615\n BTRFS error (device dm-2): Ref action 3, root 273, ref_root 273, parent 0, owner 0, offset 0, num_refs 1\n btrfs_force_cow_block+0x129/0x7d0 [btrfs]\n btrfs_cow_block+0x10a/0x250 [btrfs]\n btrfs_search_slot+0x5eb/0xf40 [btrfs]\n btrfs_insert_empty_items+0x3a/0x70 [btrfs]\n insert_with_overflow+0x53/0x130 [btrfs]\n btrfs_insert_dir_item+0x125/0x290 [btrfs]\n btrfs_add_link+0xaa/0x410 [btrfs]\n btrfs_rename+0x5ea/0xcd0 [btrfs]\n btrfs_rename2+0x28/0x60 [btrfs]\n vfs_rename+0x5b2/0xe10\n filename_renameat2+0x244/0x430\n __x64_sys_rename+0x48/0x70\n do_syscall_64+0xe1/0x790\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \n---truncated---", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "4d31778aa2fa342f5f92ca4025b293a1729161d1", "status": "affected", "versionType": "git", "lessThan": "d0284d974be46a0a06068f930c84039d540ae8ed" }, { "version": "4d31778aa2fa342f5f92ca4025b293a1729161d1", "status": "affected", "versionType": "git", "lessThan": "21bd77c132f18dc21c6fcdf417310d1adcf7448b" }, { "version": "4d31778aa2fa342f5f92ca4025b293a1729161d1", "status": "affected", "versionType": "git", "lessThan": "7ce02d52548b672795511c2cac8da6ec79ac8877" }, { "version": "4d31778aa2fa342f5f92ca4025b293a1729161d1", "status": "affected", "versionType": "git", "lessThan": "7caaae233a55e167063f4cfa3385b1a04c8bbecb" }, { "version": "4d31778aa2fa342f5f92ca4025b293a1729161d1", "status": "affected", "versionType": "git", "lessThan": "c4c78768d1a8ceb713693cc5524acbe984c31f3c" }, { "version": "4d31778aa2fa342f5f92ca4025b293a1729161d1", "status": "affected", "versionType": "git", "lessThan": "203cbfb4fba590bd9b08bd36fa6d05b5d28923bf" }, { "version": "4d31778aa2fa342f5f92ca4025b293a1729161d1", "status": "affected", "versionType": "git", "lessThan": "b5d5ab5a715001dd937c920ef8c5688fd4999ba1" }, { "version": "4d31778aa2fa342f5f92ca4025b293a1729161d1", "status": "affected", "versionType": "git", "lessThan": "cacf35832292997018837e484283f95a9301ebf5" }, { "version": "204bfcda824428b3a298eae8e87875bbd435a3c1", "status": "affected", "versionType": "git" }, { "version": "1f586802bb18892d2a6eb7d31d7fed78946d21a1", "status": "affected", "versionType": "git" }, { "version": "4.14.45", "status": "affected", "versionType": "semver", "lessThan": "4.15" }, { "version": "4.16.13", "status": "affected", "versionType": "semver", "lessThan": "4.17" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "4.17", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "4.17" }, { "version": "5.10.271", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.222", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.189", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.158", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.111", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.53", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.2.7", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.2.*" }, { "version": "7.3", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }