CVE-2026-98082 btrfs: fix the possible bioc_list memory leak during error

What is CVE-2026-98082?

CVE-2026-98082 is a medium-severity denial of service vulnerability in Linux kernel, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix the possible bioc_list memory leak during error

There are two possible ways to leak bioc memory on btrfs_ordered_extent::bioc_list:

- An error occurred for btrfs_insert_one_raid_extent() Then the function btrfs_insert_raid_extent() immediately return without freeing any bioc in the bioc_list.

- An ordered extent hit an IO error In that case the ordered extent will have BTRFS_ORDERED_IOERR set, and skip the call on btrfs_insert_raid_extent() completely.

Fix the problem by:

- Introduce a new helper, btrfs_cleanup_ordered_bioc_list() Which will remove all bioc from the bioc_list, and release the bioc.

- Call the above helper for btrfs_insert_raid_extent() So that the cleanup helper is always called no matter what.

- Call the above helper for btrfs_finish_one_ordered() This is called just before the final release on the ordered extent.

This was reported by Sashiko when reviewing another patch.

Weakness: CWE-401

Which versions are affected by CVE-2026-98082?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-98082?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-98082 being exploited?

There is no known exploitation of CVE-2026-98082 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-104877, BELL-CVE-2026-98082, DEBIAN-CVE-2026-98082, GHSA-572v-238r-mqg6, UBUNTU-CVE-2026-98082.