CVE-2026-98079 btrfs: zstd: fix lost wakeup when waiting for a workspace
A race condition in the Linux kernel's btrfs zstd compression can cause writers to hang indefinitely, leading to a local denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98079?
CVE-2026-98079 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: zstd: fix lost wakeup when waiting for a workspace
A writer can sleep forever in zstd_get_workspace() even though a workspace is free. When zstd_alloc_workspace() fails, the task is queued on zwsm->wait and schedules unconditionally, never re-testing the pool. zstd_put_workspace() publishes the workspace and then calls cond_wake_up(), which only wakes when a sleeper is already visible, so a workspace returned between the failed allocation and prepare_to_wait() wakes nobody. The window is wide: zstd_alloc_workspace() goes through kvmalloc() and may enter reclaim.
Only a max level workspace triggers the wakeup and one is deliberately kept allocated as the fallback every waiter waits for, so once its wakeup is lost the writer stays in TASK_UNINTERRUPTIBLE until some other task happens to return one. Re-check the pool after prepare_to_wait() has published the waiter, and use the workspace if one turned up.
Which versions are affected by CVE-2026-98079?
How do I fix CVE-2026-98079?
Apply the vendor's patch.
Is CVE-2026-98079 being exploited?
There is no known exploitation of CVE-2026-98079 in the wild and no public exploit code.
Sources
Also known as AZL-104858, BELL-CVE-2026-98079, DEBIAN-CVE-2026-98079, GHSA-4xrv-jf38-655f, UBUNTU-CVE-2026-98079.