CVE-2026-98907 btrfs: protect sb_write_pointer() with invalidate lock

Not scored Published 23 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-98907?

CVE-2026-98907 is a vulnerability in Linux, published on 23 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: protect sb_write_pointer() with invalidate lock

sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 ("btrfs: sync read disk super and set block size").

Take the mapping invalidate lock around read_cache_page_gfp() to serialize the read against block size changes.

Which versions are affected by CVE-2026-98907?

How do I fix CVE-2026-98907?

Upgrade to a fixed version.

Is CVE-2026-98907 being exploited?

There is no known exploitation of CVE-2026-98907 in the wild and no public exploit code.

Sources

Also known as AZL-110665, BELL-CVE-2026-98907, DEBIAN-CVE-2026-98907, GHSA-2r98-r7qj-j43v, UBUNTU-CVE-2026-98907.