Zero Radar
← feed
CriticalVulnerabilityCVE-2026-98959updated 25 Oct 2026, 17:20 UTC

Linux btrfs: changing an extended attribute can corrupt the filesystem

Replacing a file's extended attribute (small metadata tag) with a value of a different size can corrupt the btrfs filesystem and drop the attribute. Data loss or a forced read-only remount is possible.

Fix availableOfficial, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes6.6.160, 6.12.113, 6.18.57, 7.2.11 (or later in each series) · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Set xattr valueReplace a tag with a different-sized value
  2. 2btrfs_setxattr runsDeletes and reinserts a shared-hash item
  3. 3Uninitialized leaf writeNew item missing name and key fields
  4. 4Tree checker failsCorruption detected at writeback
  5. ResultAttribute lost and filesystem corrupted

What happened

In the Linux kernel's btrfs filesystem, btrfs_setxattr() deletes and reinserts a dir_item holding multiple xattrs that share a crc32c hash; when the new value has a different size, the new item is written into an uninitialized leaf region, missing its name, name length, zeroed key, BTRFS_FT_XATTR flags and transaction ID, which the tree checker later detects as corruption.

Why it is dangerous: A local user or process that can set xattrs on a btrfs file can trigger metadata corruption and a transaction abort, potentially leading to data loss or an unmountable or read-only filesystem. Systems using btrfs on affected kernels are at risk.

Are you affected?

You are affected if you run a Linux kernel from 3.19.0 up to (not including) 6.6.160, 6.7.0 up to 6.12.113, 6.13.0 up to 6.18.57, or 6.19.0 up to 7.2.11 with btrfs filesystems in use.

Package / productAffected versionsFixed in
Kernel · linux>= 3.19.0, < 6.6.1606.6.160
Kernel · linux>= 6.7.0, < 6.12.1136.12.113
Kernel · linux>= 6.13.0, < 6.18.576.18.57
Kernel · linux>= 6.19.0, < 7.2.117.2.11

What to do

  1. Update the Linux kernel to 6.6.160, 6.12.113, 6.18.57, 7.2.11 or a later patched version for your branch
  2. Reboot into the patched kernel and confirm with uname -r
  3. If you cannot patch yet, avoid setting extended attributes on btrfs files from untrusted users

Timeline

  1. 23 Oct 2026, 13:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 13:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    OSV reported on it · OSV
  4. 25 Oct 2026, 17:20 UTC
    Fixed version published: Kernel 6.6.160, Kernel 6.12.113, Kernel 6.18.57 · OSV
  5. 25 Oct 2026, 17:20 UTC
    Fix: 6.6.160, 6.12.113, 6.18.57, 7.2.11 (or later in each series)

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-98959
CVSS
9.8 / 10
EPSS
0.6% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 13:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Linux btrfs: changing an extended attribute can corrupt the filesystem · Zero Radar