{"id":"CVE-2026-98959","kind":"vulnerability","aliases":["CVE-2026-98959"],"related":[],"title":"Linux btrfs: replacing one xattr corrupts shared directory item, losing attributes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix xattr replace when multiple xattrs are packed in the same item\n\nIf we have a btrfs_dir_item item that packs multiple xattrs and then we\nreplace the value of one of them (with the setxattr(2) family of syscalls)\nwith another value of a different size, we end up not having a fully\ninitialized btrfs_dir_item, resulting in a corruption that the tree\nchecker will detect at extent buffer writeback time.\n\nThis is because in btrfs_setxattr() when we find a btrfs_dir_item with\nmultiple xattrs (due to the crc32c hash of their name being the same)\nwe delete one of the xattr items (btrfs_dir_item) and then insert a new\none, but the deletion and insertion results in shifting existing data in\nthe leaf and therefore when the new value of a xattr has a different size,\nthe new btrfs_dir_item is placed in a leaf section that was not\ninitialized and we only copy the value's data and set the value's length\nin the new btrfs_dir_item, without setting the name, the name's length,\nthe key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and\ntransaction ID.\n\nThe following script reproduces the issue:\n\n  $ cat test.sh\n  #!/bin/bash\n\n  DEV=/dev/sdi\n  MNT=/mnt/sdi\n\n  mkfs.btrfs -f $DEV\n  mount $DEV $MNT\n\n  touch $MNT/testfile\n\n  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their\n  # name and therefore are packed into the same btrfs_dir_item.\n  setfattr -n user.foobar -v 123 $MNT/testfile\n  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile\n\n  # Verify the xattrs are present.\n  echo \"xattrs before:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  # Now replace the value of the foobar xattr with a significantly larger\n  # value.\n  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile\n\n  # Check the xattrs have the expected values.\n  echo \"xattrs after:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  umount $MNT\n\nRunning it:\n\n  $ ./test.sh\n  (...)\n  xattrs before:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n  user.foobar=\"123\"\n\n  xattrs after:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n\nSo the \"user.foobar\" xattr is missing and there was a transaction abort\nwhen unmounting the fs with the following traces in dmesg:\n\n  $ dmesg\n  [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964\n  [869800.159293] ------------[ cut here ]------------\n  [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179\n  [869800.168961] Modules linked in: btrfs dm_thin_pool (...)\n  [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G        W           7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)\n  [869800.193726] Tainted: [W]=WARN\n  [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n  [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]\n  [869800.198985] Code: 48 8b 7b 18 (...)\n  [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246\n  [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000\n  [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0\n  [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff\n  [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c\n  [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069\n  [869800.229097] FS:  00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000\n  [869800.231137] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0\n  [869800.233783] Call Trace:\n  [869800.234330]  <TASK>\n  [869800.234791]  read_extent_buffer+0x4d/0x100 [btrfs]\n  [869800.235898]  btrfs_listxattr+0x199/0x240 [btrfs]\n  [869800.236912]  vfs_listxattr+0x51/0\n---truncated---","summary":"In the Linux kernel's btrfs filesystem, replacing the value of an extended attribute with a different-sized value can leave a packed directory item uninitialized, corrupting metadata. The sources describe the result as a lost xattr and a transaction abort on unmount, not a clear attacker capability.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["btrfs","infrastructure","linux","self-hosted"],"not_affected_if":["default-config","no-btrfs"],"how_to_check":"- Run `uname -r` and check whether the kernel is a release that includes the upstream btrfs fix (unknown from the sources)\n- Check whether the filesystem is btrfs with `findmnt -t btrfs`\n- Look for `BTRFS warning` or tree-checker errors in `dmesg`","fix":"- Update the Linux kernel to a release that contains the upstream btrfs xattr fix (exact version unknown from the sources)\n- Avoid replacing xattrs on btrfs volumes until patched if the update cannot be applied","status":"open","published_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:47+00:00","updated_at":"2026-10-25T04:57:47+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:57:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that contains the upstream btrfs xattr fix (exact version unknown from the sources)\n- Avoid replacing xattrs on btrfs volumes until patched if the update cannot be applied","reach":"local","title":"Linux btrfs: replacing one xattr corrupts shared directory item, losing attributes","impact":"medium","summary":"In the Linux kernel's btrfs filesystem, replacing the value of an extended attribute with a different-sized value can leave a packed directory item uninitialized, corrupting metadata. The sources describe the result as a lost xattr and a transaction abort on unmount, not a clear attacker capability.","category":"infrastructure","nicknames":[],"who_cares":["linux","btrfs","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Extended attributes go missing and filesystem metadata is corrupted.","analyst_note":"Find the upstream kernel commit and the fixed stable versions for this CVE; the sources give no versions or severity.","how_to_check":"- Run `uname -r` and check whether the kernel is a release that includes the upstream btrfs fix (unknown from the sources)\n- Check whether the filesystem is btrfs with `findmnt -t btrfs`\n- Look for `BTRFS warning` or tree-checker errors in `dmesg`","needs_analyst":true,"not_affected_if":["no-btrfs","default-config"],"who_is_affected":"Systems running the Linux kernel with btrfs filesystems where extended attributes are set on files and multiple xattrs hash to the same directory item. The sources describe a local trigger through setxattr(2) and do not describe remote exploitation. Hosts without btrfs can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000832,"input_tokens":5131,"output_tokens":638,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':464C,521C,605C,611C,617C '-2026':13A,16A '-98959':14A,17A '/bin/bash':294C '/dev/sdi':296C '/mnt/sdi':298C '/mnt/sdi/testfile':400C,408C '/test.sh':396C '0':482C '0000':575C,578C,585C,587C '0000000000000000':538C,542C,545C,555C,580C '0000000000000001':547C '0000000000000003':562C '0000000000000069':571C '0000000000003e8':552C '000000000000656c':564C,569C '0000000000370ef0':596C '0000000080050033':589C '0000000765b16004':594C '0000558dc45e6a78':592C '00007f59023bb780':574C '00010246':535C '0010':517C,583C '0018':532C '04/01/2014':514C '1':496C '123':335C,404C '16015':450C '16384':445C '18':529C '1996':511C '2':121C '244':495C '25964':452C '2605179':484C '30474240':443C '3fffffffffefffff':557C '4408':459C '48':526C '7.3.0':490C '7b':528C '8':468C,480C '869800.159271':434C '869800.159293':453C '869800.159296':456C '869800.168961':470C '869800.190527':478C '869800.193726':499C '869800.194502':503C '869800.197576':515C '869800.198985':524C '869800.203531':530C '869800.204609':536C '869800.206137':543C '869800.207645':550C '869800.226175':558C '869800.227594':565C '869800.229097':572C '869800.231137':581C '869800.232321':590C '869800.233783':597C '869800.234330':600C '869800.234791':601C '869800.235898':608C '869800.236912':614C '8b':527C 'abcdefghijklmnopqrstuvwxyz':374C 'abort':65B,422C 'absolut':353C,388C 'absolute-nam':352C,387C 'access':439C 'add':307C 'anoth':126C 'attack':71B 'attribut':11A,37B 'bio':512C 'btrfs':2A,18B,29B,83C,100C,140C,162C,168C,192C,229C,259C,280C,312C,328C,435C,466C,474C,493C,523C,607C,609C,613C 'buffer':155C,604C 'bytenr':442C 'call':598C 'capabl':72B 'cat':292C 'check':376C 'checker':150C 'clear':70B 'code':525C 'comm':485C 'copi':245C 'corrupt':6A,51B,146C 'cpu':467C,479C 'cr0':588C 'cr2':591C 'cr3':593C 'cr4':595C 'crc32c':177C,317C 'cs':582C 'cut':454C 'cve':12A,15A 'data':210C,249C 'delet':186C,203C 'describ':55B 'detect':152C 'dev':295C,301C,303C 'devic':437C 'differ':41B,130C,225C 'different-s':40B 'dir':101C,141C,169C,193C,230C,260C,329C 'directori':8A,48B 'dm':475C 'dmesg':432C,433C 'ds':584C 'due':174C 'dump':355C,390C 'eb':441C,462C,519C 'echo':348C,383C 'eflag':534C 'end':133C 'es':586C 'exist':209C 'expect':381C 'extend':36B 'extent':154C,603C 'f':300C,553C 'famili':122C 'ffff8dde054b8738':540C 'ffff8dde14be800f':567C 'ffff8de5788ed000':577C 'ffffce4541937a88':560C 'ffffce4541937d58':533C 'ffffffffc04c92a0':549C 'file':399C,407C 'filesystem':30B 'find':166C 'fix':84C 'flag':279C 'follow':78C,287C,429C 'foobar':363C 'fs':426C,573C 'fs/btrfs/extent_io.c':458C 'ft':281C 'full':498C 'fulli':138C 'g':488C 'getfattr':351C,386C,486C 'getfattr/2605179':469C 'gs':576C 'hardwar':504C 'hash':178C,316C 'host':23B 'i440fx':509C 'id':285C 'infrastructur':19B 'initi':139C,241C 'insert':197C,205C 'issu':291C 'item':9A,49B,95C,102C,103C,142C,170C,191C,194C,231C,261C,330C 'kernel':27B,76C 'key':271C 'knlgs':579C 'larger':368C 'leaf':213C,236C 'leav':45B 'len':444C,451C 'length':255C,269C 'link':472C 'linux':1A,20B,26B,75C 'listxattr':610C,616C 'lose':10A 'lost':60B 'metadata':52B 'miss':416C 'mkfs.btrfs':299C 'mnt':297C,304C,393C 'mnt/testfile':306C,336C,342C,356C,375C,391C 'modul':471C 'mount':302C 'multipl':88C,106C,172C 'must':273C 'n':332C,338C,371C 'name':181C,265C,267C,320C,354C,389C,505C 'new':199C,218C,228C,258C 'next':494C 'one':4A,115C,187C,200C 'pack':47B,91C,105C,324C 'pc':508C 'pid':483C 'piix':510C 'place':233C 'pool':477C 'preempt':497C 'present':347C 'qemu':506C 'qwerti':341C,402C,410C 'r08':554C 'r09':556C 'r10':559C 'r11':561C 'r12':563C 'r13':566C 'r14':568C 'r15':570C 'rang':448C,463C,520C 'rax':537C 'rbp':551C 'rbx':539C 'rc3':492C 'rc3-btrfs-next':491C 'rcx':541C 'rdi':548C 'rdx':544C 'read':602C 'rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org':513C 'replac':3A,31B,86C,111C,358C 'report':461C,518C 'reproduc':289C 'resolv':82C 'result':57B,143C,206C 'rip':516C 'rsi':546C 'rsp':531C 'run':394C 'script':288C 'sdi':438C 'section':237C 'self':22B 'self-host':21B 'set':251C,263C 'setfattr':331C,337C,370C 'setxattr':120C,163C 'share':7A 'shift':208C 'signific':367C 'size':42B,131C,226C 'sourc':54B 'standard':507C 'start':449C 'syscal':124C 'taint':487C,500C 'test.sh':293C 'therefor':215C,322C 'thin':476C 'time':157C 'touch':305C 'trace':430C,599C 'transact':64B,284C,421C 'tree':149C 'truncat':619C 'two':308C 'uid':481C 'umount':392C 'uniniti':50B 'unmount':67B,424C 'user.foobar':333C,372C,403C,413C 'user.wvg1c1td':339C,401C,409C 'v':334C,340C,373C 'valu':33B,43B,113C,127C,219C,247C,253C,360C,369C,382C 'verifi':343C 'vfs':615C 'vulner':79C 'w':489C,501C 'warn':436C,457C,502C 'without':262C 'writeback':156C 'x199/0x240':612C 'x44/0x60':465C,522C 'x4d/0x100':606C 'x51/0':618C 'xattr':5A,61B,85C,89C,107C,173C,190C,222C,278C,282C,309C,345C,349C,364C,378C,384C,397C,405C,414C 'zero':276C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with btrfs filesystems where extended attributes are set on files and multiple xattrs hash to the same directory item. The sources describe a local trigger through setxattr(2) and do not describe remote exploitation. Hosts without btrfs can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98959","severity":null,"published_at":"2026-10-23T13:17:17+00:00","modified_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}