{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-98959", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.382Z", "datePublished": "2026-10-23T12:19:27.679Z", "dateUpdated": "2026-10-24T14:09:39.735Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:39.735Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix xattr replace when multiple xattrs are packed in the same item\n\nIf we have a btrfs_dir_item item that packs multiple xattrs and then we\nreplace the value of one of them (with the setxattr(2) family of syscalls)\nwith another value of a different size, we end up not having a fully\ninitialized btrfs_dir_item, resulting in a corruption that the tree\nchecker will detect at extent buffer writeback time.\n\nThis is because in btrfs_setxattr() when we find a btrfs_dir_item with\nmultiple xattrs (due to the crc32c hash of their name being the same)\nwe delete one of the xattr items (btrfs_dir_item) and then insert a new\none, but the deletion and insertion results in shifting existing data in\nthe leaf and therefore when the new value of a xattr has a different size,\nthe new btrfs_dir_item is placed in a leaf section that was not\ninitialized and we only copy the value's data and set the value's length\nin the new btrfs_dir_item, without setting the name, the name's length,\nthe key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and\ntransaction ID.\n\nThe following script reproduces the issue:\n\n $ cat test.sh\n #!/bin/bash\n\n DEV=/dev/sdi\n MNT=/mnt/sdi\n\n mkfs.btrfs -f $DEV\n mount $DEV $MNT\n\n touch $MNT/testfile\n\n # Add two xattrs that, on btrfs, have the same hash (crc32c) for their\n # name and therefore are packed into the same btrfs_dir_item.\n setfattr -n user.foobar -v 123 $MNT/testfile\n setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile\n\n # Verify the xattrs are present.\n echo \"xattrs before:\"\n getfattr --absolute-names --dump $MNT/testfile\n\n # Now replace the value of the foobar xattr with a significantly larger\n # value.\n setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile\n\n # Check the xattrs have the expected values.\n echo \"xattrs after:\"\n getfattr --absolute-names --dump $MNT/testfile\n\n umount $MNT\n\nRunning it:\n\n $ ./test.sh\n (...)\n xattrs before:\n # file: /mnt/sdi/testfile\n user.WvG1c1Td=\"qwerty\"\n user.foobar=\"123\"\n\n xattrs after:\n # file: /mnt/sdi/testfile\n user.WvG1c1Td=\"qwerty\"\n\nSo the \"user.foobar\" xattr is missing and there was a transaction abort\nwhen unmounting the fs with the following traces in dmesg:\n\n $ dmesg\n [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964\n [869800.159293] ------------[ cut here ]------------\n [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179\n [869800.168961] Modules linked in: btrfs dm_thin_pool (...)\n [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G W 7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)\n [869800.193726] Tainted: [W]=WARN\n [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]\n [869800.198985] Code: 48 8b 7b 18 (...)\n [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246\n [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000\n [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0\n [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff\n [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c\n [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069\n [869800.229097] FS: 00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000\n [869800.231137] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0\n [869800.233783] Call Trace:\n [869800.234330] \n [869800.234791] read_extent_buffer+0x4d/0x100 [btrfs]\n [869800.235898] btrfs_listxattr+0x199/0x240 [btrfs]\n [869800.236912] vfs_listxattr+0x51/0\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - An NFSv4.2 OP_SETXATTR carries each attacker-chosen name and value; nfsd4_decode_xattr_name() prepends user. and nfsd_setxattr() reaches the patched btrfs_setxattr(). One client can send two CRC32C-colliding names followed by a different-sized replacement.\nAC:L - btrfs_name_hash() uses unkeyed CRC32C, permitting deterministic chosen-target, non-NUL collisions; the commit also supplies a fixed collision. Sequential OP_SETXATTR operations fully control packing and replacement without a race or external precondition.\nPR:N - With an AUTH_SYS NFS export, the client merely asserts a uid; nfsd_setxattr() gates the operation with fh_verify(..., NFSD_MAY_WRITE) before __vfs_setxattr_locked(). An unauthenticated client can assert the writable file's owner uid.\nUI:N - The attacker alone can issue PUTFH, the setup and replacement OP_SETXATTR operations, and subsequent GETXATTR operations. No victim must mount attacker-supplied media, open a file, or take another action.\nS:U - The malformed btrfs_dir_item, forged xattrs, leaf disclosure, and transaction abort all affect the same host kernel and filesystem security authority; no VM, IOMMU, or other isolation boundary is crossed.\nC:H - Crafted lengths make btrfs_match_dir_item_name() parse a fake user.* dir_item embedded in the replacement value. Its chosen data_len makes btrfs_getxattr()/read_extent_buffer() copy adjacent leaf contents, including potentially inline data, which NFSv4.2 GETXATTR returns.\nI:H - The same controlled parse can embed a complete security.capability dir_item whose CRC32C matches the item key. btrfs_getxattr() can then supply attacker-chosen V2 capabilities to get_vfs_caps_from_disk(), bypassing CAP_SETFCAP and permitting root code execution.\nA:H - check_dir_item() rejects the malformed entry when btrfs_check_leaf() runs from btree_csum_one_bio(); the resulting writeback failure aborts the transaction and forces the Btrfs filesystem read-only." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/xattr.c" ], "versions": [ { "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339", "lessThan": "7a53bb4668b319fc6c8a3ce2c21635125c7d2712", "status": "affected", "versionType": "git" }, { "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339", "lessThan": "5877d7138cc4359d26fd7b010eedfd1b3162348f", "status": "affected", "versionType": "git" }, { "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339", "lessThan": "a97114b9b00ed3d05156f3b2ddbf797296260389", "status": "affected", "versionType": "git" }, { "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339", "lessThan": "c1803697a60f22743aa28ad522f805e92d45e3f0", "status": "affected", "versionType": "git" }, { "version": "5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339", "lessThan": "858bee1c77857aabcc2327cd32dd8266332de332", "status": "affected", "versionType": "git" }, { "version": "43f2e3615d181a7028ab797114c5960977669b2a", "status": "affected", "versionType": "git" }, { "version": "a873146ce4fb025c0b5c1322af5a6bad042f5363", "status": "affected", "versionType": "git" }, { "version": "02590fd855d1690568b2fa439c942e933221b57a", "status": "affected", "versionType": "git" }, { "version": "55e97f654cbbbef70f9714f0e113604dd931e360", "status": "affected", "versionType": "git" }, { "version": "3.10.83", "lessThan": "3.11", "status": "affected", "versionType": "semver" }, { "version": "3.12.45", "lessThan": "3.13", "status": "affected", "versionType": "semver" }, { "version": "3.14.47", "lessThan": "3.15", "status": "affected", "versionType": "semver" }, { "version": "3.18.19", "lessThan": "3.19", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/xattr.c" ], "versions": [ { "version": "3.19", "status": "affected" }, { "version": "0", "lessThan": "3.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.6.160" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.12.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.18.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.2.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12.45" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14.47" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18.19" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7a53bb4668b319fc6c8a3ce2c21635125c7d2712" }, { "url": "https://git.kernel.org/stable/c/5877d7138cc4359d26fd7b010eedfd1b3162348f" }, { "url": "https://git.kernel.org/stable/c/a97114b9b00ed3d05156f3b2ddbf797296260389" }, { "url": "https://git.kernel.org/stable/c/c1803697a60f22743aa28ad522f805e92d45e3f0" }, { "url": "https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332" } ], "title": "btrfs: fix xattr replace when multiple xattrs are packed in the same item", "x_generator": { "engine": "bippy-1.2.0" } } } }