Linux Kernel btrfs sb_write_pointer Race via BLKBSZSET
CVE-2026-98907 Published on October 23, 2026
btrfs: protect sb_write_pointer() with invalidate lock
In the Linux kernel, the following vulnerability has been resolved:
btrfs: protect sb_write_pointer() with invalidate lock
sb_write_pointer() reads the super block from the block device page cache
using read_cache_page_gfp(). This has the same race with BLKBSZSET as the
one fixed by commit 3f29d661e568 ("btrfs: sync read disk super and set
block size").
Take the mapping invalidate lock around read_cache_page_gfp() to
serialize the read against block size changes.
Products Associated with CVE-2026-98907
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version 3c20917120ce61f2a123ca0810293872f4c6b5a4 and below 80cd97c5e90096d040a623851795eac92fbd0ff1 is affected.
- Version 3c20917120ce61f2a123ca0810293872f4c6b5a4 and below 123b9a545f4d0348e81f558a032bf2a93ee5722f is affected.
- Version 6.15 is affected.
- Before 6.15 is unaffected.
- Version 6.18.53, <= 6.18.* is unaffected.
- Version 7.2, <= * is unaffected.