CVE-2026-98959 (GCVE-0-2026-98959)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:19 – Updated: 2026-10-24 14:09
VLAI
Title
btrfs: fix xattr replace when multiple xattrs are packed in the same item
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs_dir_item item that packs multiple xattrs and then we replace the value of one of them (with the setxattr(2) family of syscalls) with another value of a different size, we end up not having a fully initialized btrfs_dir_item, resulting in a corruption that the tree checker will detect at extent buffer writeback time. This is because in btrfs_setxattr() when we find a btrfs_dir_item with multiple xattrs (due to the crc32c hash of their name being the same) we delete one of the xattr items (btrfs_dir_item) and then insert a new one, but the deletion and insertion results in shifting existing data in the leaf and therefore when the new value of a xattr has a different size, the new btrfs_dir_item is placed in a leaf section that was not initialized and we only copy the value's data and set the value's length in the new btrfs_dir_item, without setting the name, the name's length, the key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and transaction ID. The following script reproduces the issue: $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi mkfs.btrfs -f $DEV mount $DEV $MNT touch $MNT/testfile # Add two xattrs that, on btrfs, have the same hash (crc32c) for their # name and therefore are packed into the same btrfs_dir_item. setfattr -n user.foobar -v 123 $MNT/testfile setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile # Verify the xattrs are present. echo "xattrs before:" getfattr --absolute-names --dump $MNT/testfile # Now replace the value of the foobar xattr with a significantly larger # value. setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile # Check the xattrs have the expected values. echo "xattrs after:" getfattr --absolute-names --dump $MNT/testfile umount $MNT Running it: $ ./test.sh (...) xattrs before: # file: /mnt/sdi/testfile user.WvG1c1Td="qwerty" user.foobar="123" xattrs after: # file: /mnt/sdi/testfile user.WvG1c1Td="qwerty" So the "user.foobar" xattr is missing and there was a transaction abort when unmounting the fs with the following traces in dmesg: $ dmesg [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964 [869800.159293] ------------[ cut here ]------------ [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179 [869800.168961] Modules linked in: btrfs dm_thin_pool (...) [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G W 7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full) [869800.193726] Tainted: [W]=WARN [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs] [869800.198985] Code: 48 8b 7b 18 (...) [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246 [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000 [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0 [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069 [869800.229097] FS: 00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000 [869800.231137] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0 [869800.233783] Call Trace: [869800.234330] <TASK> [869800.234791] read_extent_buffer+0x4d/0x100 [btrfs] [869800.235898] btrfs_listxattr+0x199/0x240 [btrfs] [869800.236912] vfs_listxattr+0x51/0 ---truncated---
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7063 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 , < 7a53bb4668b319fc6c8a3ce2c21635125c7d2712 (git)
Affected: 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 , < 5877d7138cc4359d26fd7b010eedfd1b3162348f (git)
Affected: 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 , < a97114b9b00ed3d05156f3b2ddbf797296260389 (git)
Affected: 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 , < c1803697a60f22743aa28ad522f805e92d45e3f0 (git)
Affected: 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 , < 858bee1c77857aabcc2327cd32dd8266332de332 (git)
Affected: 43f2e3615d181a7028ab797114c5960977669b2a (git)
Affected: a873146ce4fb025c0b5c1322af5a6bad042f5363 (git)
Affected: 02590fd855d1690568b2fa439c942e933221b57a (git)
Affected: 55e97f654cbbbef70f9714f0e113604dd931e360 (git)
Affected: 3.10.83 , < 3.11 (semver)
Affected: 3.12.45 , < 3.13 (semver)
Affected: 3.14.47 , < 3.15 (semver)
Affected: 3.18.19 , < 3.19 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 6.6.160 , ≤ 6.6.* (semver)
Unaffected: 6.12.113 , ≤ 6.12.* (semver)
Unaffected: 6.18.57 , ≤ 6.18.* (semver)
Unaffected: 7.2.11 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7a53bb4668b319fc6c8a3ce2c21635125c7d2712",
              "status": "affected",
              "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
              "versionType": "git"
            },
            {
              "lessThan": "5877d7138cc4359d26fd7b010eedfd1b3162348f",
              "status": "affected",
              "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
              "versionType": "git"
            },
            {
              "lessThan": "a97114b9b00ed3d05156f3b2ddbf797296260389",
              "status": "affected",
              "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
              "versionType": "git"
            },
            {
              "lessThan": "c1803697a60f22743aa28ad522f805e92d45e3f0",
              "status": "affected",
              "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
              "versionType": "git"
            },
            {
              "lessThan": "858bee1c77857aabcc2327cd32dd8266332de332",
              "status": "affected",
              "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "43f2e3615d181a7028ab797114c5960977669b2a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a873146ce4fb025c0b5c1322af5a6bad042f5363",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "02590fd855d1690568b2fa439c942e933221b57a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "55e97f654cbbbef70f9714f0e113604dd931e360",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.83",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.45",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.47",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.19",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.83",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.14.47",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix xattr replace when multiple xattrs are packed in the same item\n\nIf we have a btrfs_dir_item item that packs multiple xattrs and then we\nreplace the value of one of them (with the setxattr(2) family of syscalls)\nwith another value of a different size, we end up not having a fully\ninitialized btrfs_dir_item, resulting in a corruption that the tree\nchecker will detect at extent buffer writeback time.\n\nThis is because in btrfs_setxattr() when we find a btrfs_dir_item with\nmultiple xattrs (due to the crc32c hash of their name being the same)\nwe delete one of the xattr items (btrfs_dir_item) and then insert a new\none, but the deletion and insertion results in shifting existing data in\nthe leaf and therefore when the new value of a xattr has a different size,\nthe new btrfs_dir_item is placed in a leaf section that was not\ninitialized and we only copy the value\u0027s data and set the value\u0027s length\nin the new btrfs_dir_item, without setting the name, the name\u0027s length,\nthe key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and\ntransaction ID.\n\nThe following script reproduces the issue:\n\n  $ cat test.sh\n  #!/bin/bash\n\n  DEV=/dev/sdi\n  MNT=/mnt/sdi\n\n  mkfs.btrfs -f $DEV\n  mount $DEV $MNT\n\n  touch $MNT/testfile\n\n  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their\n  # name and therefore are packed into the same btrfs_dir_item.\n  setfattr -n user.foobar -v 123 $MNT/testfile\n  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile\n\n  # Verify the xattrs are present.\n  echo \"xattrs before:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  # Now replace the value of the foobar xattr with a significantly larger\n  # value.\n  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile\n\n  # Check the xattrs have the expected values.\n  echo \"xattrs after:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  umount $MNT\n\nRunning it:\n\n  $ ./test.sh\n  (...)\n  xattrs before:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n  user.foobar=\"123\"\n\n  xattrs after:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n\nSo the \"user.foobar\" xattr is missing and there was a transaction abort\nwhen unmounting the fs with the following traces in dmesg:\n\n  $ dmesg\n  [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964\n  [869800.159293] ------------[ cut here ]------------\n  [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179\n  [869800.168961] Modules linked in: btrfs dm_thin_pool (...)\n  [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G        W           7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)\n  [869800.193726] Tainted: [W]=WARN\n  [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n  [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]\n  [869800.198985] Code: 48 8b 7b 18 (...)\n  [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246\n  [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000\n  [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0\n  [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff\n  [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c\n  [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069\n  [869800.229097] FS:  00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000\n  [869800.231137] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0\n  [869800.233783] Call Trace:\n  [869800.234330]  \u003cTASK\u003e\n  [869800.234791]  read_extent_buffer+0x4d/0x100 [btrfs]\n  [869800.235898]  btrfs_listxattr+0x199/0x240 [btrfs]\n  [869800.236912]  vfs_listxattr+0x51/0\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An NFSv4.2 OP_SETXATTR carries each attacker-chosen name and value; nfsd4_decode_xattr_name() prepends user. and nfsd_setxattr() reaches the patched btrfs_setxattr(). One client can send two CRC32C-colliding names followed by a different-sized replacement.\nAC:L - btrfs_name_hash() uses unkeyed CRC32C, permitting deterministic chosen-target, non-NUL collisions; the commit also supplies a fixed collision. Sequential OP_SETXATTR operations fully control packing and replacement without a race or external precondition.\nPR:N - With an AUTH_SYS NFS export, the client merely asserts a uid; nfsd_setxattr() gates the operation with fh_verify(..., NFSD_MAY_WRITE) before __vfs_setxattr_locked(). An unauthenticated client can assert the writable file\u0027s owner uid.\nUI:N - The attacker alone can issue PUTFH, the setup and replacement OP_SETXATTR operations, and subsequent GETXATTR operations. No victim must mount attacker-supplied media, open a file, or take another action.\nS:U - The malformed btrfs_dir_item, forged xattrs, leaf disclosure, and transaction abort all affect the same host kernel and filesystem security authority; no VM, IOMMU, or other isolation boundary is crossed.\nC:H - Crafted lengths make btrfs_match_dir_item_name() parse a fake user.* dir_item embedded in the replacement value. Its chosen data_len makes btrfs_getxattr()/read_extent_buffer() copy adjacent leaf contents, including potentially inline data, which NFSv4.2 GETXATTR returns.\nI:H - The same controlled parse can embed a complete security.capability dir_item whose CRC32C matches the item key. btrfs_getxattr() can then supply attacker-chosen V2 capabilities to get_vfs_caps_from_disk(), bypassing CAP_SETFCAP and permitting root code execution.\nA:H - check_dir_item() rejects the malformed entry when btrfs_check_leaf() runs from btree_csum_one_bio(); the resulting writeback failure aborts the transaction and forces the Btrfs filesystem read-only."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:09:39.735Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7a53bb4668b319fc6c8a3ce2c21635125c7d2712"
        },
        {
          "url": "https://git.kernel.org/stable/c/5877d7138cc4359d26fd7b010eedfd1b3162348f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a97114b9b00ed3d05156f3b2ddbf797296260389"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1803697a60f22743aa28ad522f805e92d45e3f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332"
        }
      ],
      "title": "btrfs: fix xattr replace when multiple xattrs are packed in the same item",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98959",
    "datePublished": "2026-10-23T12:19:27.679Z",
    "dateReserved": "2026-09-25T10:25:14.382Z",
    "dateUpdated": "2026-10-24T14:09:39.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98959",
      "date": "2026-10-27",
      "epss": "0.00607",
      "percentile": "0.48816"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-26T14:48:02.000Z",
      "cve": "CVE-2026-98959",
      "id": "msrc_CVE-2026-98959",
      "initial_release_date": "2026-10-24T01:09:52.000Z",
      "product_status:known_affected": "1",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: fix xattr replace when multiple xattrs are packed in the same item",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98959.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/xattr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7a53bb4668b319fc6c8a3ce2c21635125c7d2712",
                    "status": "affected",
                    "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5877d7138cc4359d26fd7b010eedfd1b3162348f",
                    "status": "affected",
                    "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a97114b9b00ed3d05156f3b2ddbf797296260389",
                    "status": "affected",
                    "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c1803697a60f22743aa28ad522f805e92d45e3f0",
                    "status": "affected",
                    "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "858bee1c77857aabcc2327cd32dd8266332de332",
                    "status": "affected",
                    "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "43f2e3615d181a7028ab797114c5960977669b2a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "a873146ce4fb025c0b5c1322af5a6bad042f5363",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "02590fd855d1690568b2fa439c942e933221b57a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "55e97f654cbbbef70f9714f0e113604dd931e360",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3.11",
                    "status": "affected",
                    "version": "3.10.83",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.13",
                    "status": "affected",
                    "version": "3.12.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.15",
                    "status": "affected",
                    "version": "3.14.47",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "affected",
                    "version": "3.18.19",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/xattr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.19"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix xattr replace when multiple xattrs are packed in the same item\n\nIf we have a btrfs_dir_item item that packs multiple xattrs and then we\nreplace the value of one of them (with the setxattr(2) family of syscalls)\nwith another value of a different size, we end up not having a fully\ninitialized btrfs_dir_item, resulting in a corruption that the tree\nchecker will detect at extent buffer writeback time.\n\nThis is because in btrfs_setxattr() when we find a btrfs_dir_item with\nmultiple xattrs (due to the crc32c hash of their name being the same)\nwe delete one of the xattr items (btrfs_dir_item) and then insert a new\none, but the deletion and insertion results in shifting existing data in\nthe leaf and therefore when the new value of a xattr has a different size,\nthe new btrfs_dir_item is placed in a leaf section that was not\ninitialized and we only copy the value\u0027s data and set the value\u0027s length\nin the new btrfs_dir_item, without setting the name, the name\u0027s length,\nthe key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and\ntransaction ID.\n\nThe following script reproduces the issue:\n\n  $ cat test.sh\n  #!/bin/bash\n\n  DEV=/dev/sdi\n  MNT=/mnt/sdi\n\n  mkfs.btrfs -f $DEV\n  mount $DEV $MNT\n\n  touch $MNT/testfile\n\n  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their\n  # name and therefore are packed into the same btrfs_dir_item.\n  setfattr -n user.foobar -v 123 $MNT/testfile\n  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile\n\n  # Verify the xattrs are present.\n  echo \"xattrs before:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  # Now replace the value of the foobar xattr with a significantly larger\n  # value.\n  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile\n\n  # Check the xattrs have the expected values.\n  echo \"xattrs after:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  umount $MNT\n\nRunning it:\n\n  $ ./test.sh\n  (...)\n  xattrs before:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n  user.foobar=\"123\"\n\n  xattrs after:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n\nSo the \"user.foobar\" xattr is missing and there was a transaction abort\nwhen unmounting the fs with the following traces in dmesg:\n\n  $ dmesg\n  [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964\n  [869800.159293] ------------[ cut here ]------------\n  [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179\n  [869800.168961] Modules linked in: btrfs dm_thin_pool (...)\n  [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G        W           7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)\n  [869800.193726] Tainted: [W]=WARN\n  [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n  [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]\n  [869800.198985] Code: 48 8b 7b 18 (...)\n  [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246\n  [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000\n  [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0\n  [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff\n  [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c\n  [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069\n  [869800.229097] FS:  00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000\n  [869800.231137] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0\n  [869800.233783] Call Trace:\n  [869800.234330]  \u003cTASK\u003e\n  [869800.234791]  read_extent_buffer+0x4d/0x100 [btrfs]\n  [869800.235898]  btrfs_listxattr+0x199/0x240 [btrfs]\n  [869800.236912]  vfs_listxattr+0x51/0\n---truncated---"
          }
        ],
        "id": "CVE-2026-98959",
        "lastModified": "2026-10-24T14:16:49.307",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-23T13:17:17.233",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5877d7138cc4359d26fd7b010eedfd1b3162348f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7a53bb4668b319fc6c8a3ce2c21635125c7d2712"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a97114b9b00ed3d05156f3b2ddbf797296260389"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c1803697a60f22743aa28ad522f805e92d45e3f0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.