Live › vulnerability › CVE-2026-98907
Go to dashboardA race in the Linux kernel's btrfs code lets the superblock read in sb_write_pointer() run while the block device's block size is being changed. The sources do not state what an attacker gains from this race.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with btrfs filesystems on block devices where the block size can be changed while the filesystem is in use. The sources do not say how an attacker reaches this path, so exposure is unknown. Systems that do not use btrfs can likely skip it.
No product ranges from the sources yet.
uname -r to see the running kernel version and compare it against the fixed kernel listed in the NVD record.lsblk -f or findmnt -t btrfs.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
btrfs: protect sb_write_pointer() with invalidate lock
sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 ("btrfs: sync read disk super and set block size").
Take the mapping invalidate lock around read_cache_page_gfp() to serialize the read against block size changes.
This page as .md · .json · in your agent: get_signal("CVE-2026-98907")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.