{"id":"CVE-2026-98907","kind":"vulnerability","aliases":["CVE-2026-98907"],"related":[],"title":"Linux kernel btrfs: race when reading superblock during block size change","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: protect sb_write_pointer() with invalidate lock\n\nsb_write_pointer() reads the super block from the block device page cache\nusing read_cache_page_gfp(). This has the same race with BLKBSZSET as the\none fixed by commit 3f29d661e568 (\"btrfs: sync read disk super and set\nblock size\").\n\nTake the mapping invalidate lock around read_cache_page_gfp() to\nserialize the read against block size changes.","summary":"A race in the Linux kernel's btrfs code lets the superblock read in sb_write_pointer() run while the block device's block size is being changed. The sources do not state what an attacker gains from this race.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["btrfs","infrastructure","linux-kernel","self-hosted"],"not_affected_if":["no-btrfs"],"how_to_check":"- Run `uname -r` to see the running kernel version and compare it against the fixed kernel listed in the NVD record.\n- Check whether btrfs is in use with `lsblk -f` or `findmnt -t btrfs`.","fix":"- Install the kernel release that contains the upstream btrfs fix (commit subject: 'btrfs: protect sb_write_pointer() with invalidate lock'); the fixed version is unknown from these sources.\n- Reboot into the patched kernel.","status":"open","published_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:34+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:58:34Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel release that contains the upstream btrfs fix (commit subject: 'btrfs: protect sb_write_pointer() with invalidate lock'); the fixed version is unknown from these sources.\n- Reboot into the patched kernel.","reach":"local","title":"Linux kernel btrfs: race when reading superblock during block size change","impact":"low","summary":"A race in the Linux kernel's btrfs code lets the superblock read in sb_write_pointer() run while the block device's block size is being changed. The sources do not state what an attacker gains from this race.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","btrfs","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not describe the impact","analyst_note":"Check the NVD entry and the upstream kernel commit to learn the attacker capability, affected version range and fixed kernel version.","how_to_check":"- Run `uname -r` to see the running kernel version and compare it against the fixed kernel listed in the NVD record.\n- Check whether btrfs is in use with `lsblk -f` or `findmnt -t btrfs`.","needs_analyst":true,"not_affected_if":["no-btrfs"],"who_is_affected":"Systems running a Linux kernel with btrfs filesystems on block devices where the block size can be changed while the filesystem is in use. The sources do not say how an attacker reaches this path, so exposure is unknown. Systems that do not use btrfs can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000625,"input_tokens":3384,"output_tokens":574,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98907':14A,17A '3f29d661e568':115C 'around':130C 'attack':61B 'blkbszset':108C 'block':9A,46B,49B,90C,93C,123C,140C 'btrfs':3A,18B,33B,76C,116C 'cach':96C,99C,132C 'chang':11A,53B,142C 'code':34B 'commit':114C 'cve':12A,15A 'devic':47B,94C 'disk':119C 'fix':112C 'follow':71C 'gain':62B 'gfp':101C,134C 'host':25B 'infrastructur':19B 'invalid':82C,128C 'kernel':2A,22B,31B,69C 'let':35B 'linux':1A,21B,30B,68C 'linux-kernel':20B 'lock':83C,129C 'map':127C 'one':111C 'page':95C,100C,133C 'pointer':42B,80C,86C 'protect':77C 'race':4A,27B,65B,106C 'read':6A,38B,87C,98C,118C,131C,138C 'resolv':75C 'run':43B 'sb':40B,78C,84C 'self':24B 'self-host':23B 'serial':136C 'set':122C 'size':10A,50B,124C,141C 'sourc':55B 'state':58B 'super':89C,120C 'superblock':7A,37B 'sync':117C 'take':125C 'use':97C 'vulner':72C 'write':41B,79C,85C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with btrfs filesystems on block devices where the block size can be changed while the filesystem is in use. The sources do not say how an attacker reaches this path, so exposure is unknown. Systems that do not use btrfs can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98907","severity":null,"published_at":"2026-10-23T12:18:24+00:00","modified_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98907","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98907","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}