https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 17:07:22 +0000 https://db.gcve.eu/vuln/cve-2026-98083 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>btrfs: fix transaction use-after-free in raid stripe insertion</p> <p>If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM.</p> <p>btrfs_finish_one_ordered(), the production caller through btrfs_insert_raid_extent(), still owns the transaction handle. It handles the error by aborting the transaction and then reaches the common exit path, which ends the transaction again.</p> <p>The premature end can free the handle and drop its transaction reference. Transaction cleanup can then free the transaction before the caller&#39;s second abort accesses the handle and transaction, resulting in use-after-free.</p> <p>Keep the abort at the failure site, but let the caller&#39;s common exit path end the transaction once, after it has finished using both objects.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>btrfs: fix transaction use-after-free in raid stripe insertion</p> <p>If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM.</p> <p>btrfs_finish_one_ordered(), the production caller through btrfs_insert_raid_extent(), still owns the transaction handle. It handles the error by aborting the transaction and then reaches the common exit path, which ends the transaction again.</p> <p>The premature end can free the handle and drop its transaction reference. Transaction cleanup can then free the transaction before the caller&#39;s second abort accesses the handle and transaction, resulting in use-after-free.</p> <p>Keep the abort at the failure site, but let the caller&#39;s common exit path end the transaction once, after it has finished using both objects.</p> https://db.gcve.eu/vuln/cve-2026-98083