{"id":"CVE-2026-98080","summary":"btrfs: do not force reloc root creation during qgroup_account_snapshot()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not force reloc root creation during qgroup_account_snapshot()\n\n[BUG]\nWhen running btrfs/252 with quota enabled through MKFS_OPTIONS=\"-O quota\",\nit has a high chance to trigger the following kernel warning and flips\nthe fs RO:\n\n  BTRFS info (device dm-2): relocating block group 30408704 flags metadata|dup\n  ------------[ cut here ]------------\n  WARNING: fs/btrfs/extent-tree.c:879 at lookup_inline_extent_backref+0x74b/0x960 [btrfs], CPU#4: btrfs/2173\n  CPU: 4 UID: 0 PID: 2173 Comm: btrfs Not tainted 7.2.0-rc6-custom+ #457 PREEMPT(full)  3adc6528fb66f7a55fe1095385818e742f200aab\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n  RIP: 0010:lookup_inline_extent_backref+0x74b/0x960 [btrfs]\n  Call Trace:\n   \u003cTASK\u003e\n   insert_inline_extent_backref+0x7c/0x160 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   __btrfs_inc_extent_ref+0xa9/0x270 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   __btrfs_run_delayed_refs+0x4af/0x11c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_run_delayed_refs+0x9d/0xf0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   create_pending_snapshot+0x39d/0xf00 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   create_pending_snapshots+0x9b/0xc0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_commit_transaction+0x280/0xeb0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   prepare_to_relocate+0x147/0x200 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   relocate_block_group+0x6b/0x5e0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_relocate_block_group+0x92c/0x2380 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_relocate_chunk+0x3f/0x1a0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_balance+0xa2c/0x19c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_ioctl+0x2839/0x2d30 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   __x64_sys_ioctl+0x416/0x9a0\n   do_syscall_64+0xe1/0x790\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u003c/TASK\u003e\n  ---[ end trace 0000000000000000 ]---\n  BTRFS info (device dm-2): leaf 4593991680 gen 233 total ptrs 175 free space 5953 owner 2\n  BTRFS info (device dm-2): refs 3 lock_owner 2173 current 2173\n  \titem 0 key (166772736 METADATA_ITEM 1) itemoff 16250 itemsize 33\n  \t\textent refs 1 gen 222 flags 2\n  \t\tref#0: tree block backref root 266\n         [ Skip the tree dump ]\n  \titem 174 key (263225344 METADATA_ITEM 0) itemoff 10328 itemsize 33\n  \t\textent refs 1 gen 162 flags 258\n  \t\tref#0: tree block backref root 267\n  BTRFS error (device dm-2): extent item not found for insert, bytenr 179847168 num_bytes 16384 parent 4594335744 root_objectid 273 owner 0 offset 0\n  BTRFS error (device dm-2): failed to run delayed ref for logical 179847168 num_bytes 16384 type 182 action 1 ref_mod 1: -117\n\n[CAUSE]\nThe above error is showing that there is a tree reference to a metadata\nextent that is no longer there.\n\nWith \"ref_verify\" mount option (requires CONFIG_BTRFS_DEBUG), there is\nsome extra debug output:\n\n  BTRFS error (device dm-2): dumping block entry [180961280 16384], num_refs 0, metadata 1, from disk 0\n  BTRFS error (device dm-2):   root entry 256, num_refs 18446744073709551615\n  BTRFS error (device dm-2):   root entry 273, num_refs 18446744073709551615\n  BTRFS error (device dm-2):   Ref action 3, root 273, ref_root 273, parent 0, owner 0, offset 0, num_refs 1\n     btrfs_force_cow_block+0x129/0x7d0 [btrfs]\n     btrfs_cow_block+0x10a/0x250 [btrfs]\n     btrfs_search_slot+0x5eb/0xf40 [btrfs]\n     btrfs_insert_empty_items+0x3a/0x70 [btrfs]\n     insert_with_overflow+0x53/0x130 [btrfs]\n     btrfs_insert_dir_item+0x125/0x290 [btrfs]\n     btrfs_add_link+0xaa/0x410 [btrfs]\n     btrfs_rename+0x5ea/0xcd0 [btrfs]\n     btrfs_rename2+0x28/0x60 [btrfs]\n     vfs_rename+0x5b2/0xe10\n     filename_renameat2+0x244/0x430\n     __x64_sys_rename+0x48/0x70\n     do_syscall_64+0xe1/0x790\n     entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \n---truncated---","modified":"2026-11-13T04:07:28.048454192Z","published":"2026-09-25T10:24:17.491Z","related":["SUSE-SU-2026:24181-1","SUSE-SU-2026:24182-1","SUSE-SU-2026:24315-1","SUSE-SU-2026:24316-1","SUSE-SU-2026:24643-1","SUSE-SU-2026:24648-1","SUSE-SU-2026:24651-1","SUSE-SU-2026:24662-1","SUSE-SU-2026:4640-1","SUSE-SU-2026:4687-1","SUSE-SU-2026:4706-1","openSUSE-SU-2026:12074-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98080.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/203cbfb4fba590bd9b08bd36fa6d05b5d28923bf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/21bd77c132f18dc21c6fcdf417310d1adcf7448b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7caaae233a55e167063f4cfa3385b1a04c8bbecb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7ce02d52548b672795511c2cac8da6ec79ac8877"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b5d5ab5a715001dd937c920ef8c5688fd4999ba1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c4c78768d1a8ceb713693cc5524acbe984c31f3c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cacf35832292997018837e484283f95a9301ebf5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d0284d974be46a0a06068f930c84039d540ae8ed"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98080.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98080"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4d31778aa2fa342f5f92ca4025b293a1729161d1"},{"fixed":"d0284d974be46a0a06068f930c84039d540ae8ed"},{"fixed":"21bd77c132f18dc21c6fcdf417310d1adcf7448b"},{"fixed":"7ce02d52548b672795511c2cac8da6ec79ac8877"},{"fixed":"7caaae233a55e167063f4cfa3385b1a04c8bbecb"},{"fixed":"c4c78768d1a8ceb713693cc5524acbe984c31f3c"},{"fixed":"203cbfb4fba590bd9b08bd36fa6d05b5d28923bf"},{"fixed":"b5d5ab5a715001dd937c920ef8c5688fd4999ba1"},{"fixed":"cacf35832292997018837e484283f95a9301ebf5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"204bfcda824428b3a298eae8e87875bbd435a3c1"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"1f586802bb18892d2a6eb7d31d7fed78946d21a1"}]}],"versions":["v4.14.336","v4.14.335","v4.14.334","v4.14.333","v4.14.332","v4.14.331","v4.14.330","v4.14.329","v4.14.328","v4.14.327","v4.14.326","v4.14.325","v4.14.324","v4.14.323","v4.14.322","v4.14.321","v4.14.320","v4.14.319","v4.14.318","v4.14.317","v4.14.316","v4.14.315","v4.14.314","v4.14.313","v4.14.312","v4.14.311","v4.14.310","v4.14.309","v4.14.308","v4.14.307","v4.14.306","v4.14.305","v4.14.304","v4.14.303","v4.14.302","v4.14.301","v4.14.300","v4.14.299","v4.14.298","v4.14.297","v4.14.296","v4.14.295","v4.14.294","v4.14.293","v4.14.292","v4.14.291","v4.14.290","v4.14.289","v4.14.288","v4.14.287","v4.14.286","v4.14.285","v4.14.284","v4.14.283","v4.14.282","v4.14.281","v4.14.280","v4.14.279","v4.14.278","v4.14.277","v4.14.276","v4.14.275","v4.14.274","v4.14.273","v4.14.272","v4.14.271","v4.14.270","v4.14.269","v4.14.268","v4.14.267","v4.14.266","v4.14.265","v4.14.264","v4.14.263","v4.14.262","v4.14.261","v4.14.260","v4.14.259","v4.14.258","v4.14.257","v4.14.256","v4.14.255","v4.14.254","v4.14.253","v4.14.252","v4.14.251","v4.14.250","v4.14.249","v4.14.248","v4.14.247","v4.14.246","v4.14.245","v4.14.244","v4.14.243","v4.14.242","v4.14.241","v4.14.240","v4.14.239","v4.14.238","v4.14.237","v4.14.236","v4.14.235","v4.14.234","v4.14.233","v4.14.232","v4.14.231","v4.14.230","v4.14.229","v4.14.228","v4.14.227","v4.14.226","v4.14.225","v4.14.224","v4.14.223","v4.14.222","v4.14.221","v4.14.220","v4.14.219","v4.14.218","v4.14.217","v4.14.216","v4.14.215","v4.14.214","v4.14.213","v4.14.212","v4.14.211","v4.14.210","v4.14.209","v4.14.208","v4.14.207","v4.14.206","v4.14.205","v4.14.204","v4.14.203","v4.14.202","v4.14.201","v4.14.200","v4.14.199","v4.14.198","v4.14.197","v4.14.196","v4.14.195","v4.14.194","v4.14.193","v4.14.192","v4.14.191","v4.14.190","v4.14.189","v4.14.188","v4.14.187","v4.14.186","v4.14.185","v4.14.184","v4.14.183","v4.14.182","v4.14.181","v4.14.180","v4.14.179","v4.14.178","v4.14.177","v4.14.176","v4.14.175","v4.14.174","v4.14.173","v4.14.172","v4.14.171","v4.14.170","v4.14.169","v4.14.168","v4.14.167","v4.14.166","v4.14.165","v4.14.164","v4.14.163","v4.14.162","v4.14.161","v4.14.160","v4.14.159","v4.14.158","v4.14.157","v4.14.156","v4.14.155","v4.14.154","v4.14.153","v4.14.152","v4.14.151","v4.14.150","v4.14.149","v4.14.148","v4.14.147","v4.14.146","v4.14.145","v4.14.144","v4.14.143","v4.14.142","v4.14.141","v4.14.140","v4.14.139","v4.14.138","v4.14.137","v4.14.136","v4.14.135","v4.14.134","v4.14.133","v4.14.132","v4.14.131","v4.14.130","v4.14.129","v4.14.128","v4.14.127","v4.14.126","v4.14.125","v4.14.124","v4.14.123","v4.14.122","v4.14.121","v4.14.120","v4.14.119","v4.14.118","v4.14.117","v4.14.116","v4.14.115","v4.14.114","v4.14.113","v4.14.112","v4.14.111","v4.14.110","v4.14.109","v4.14.108","v4.14.107","v4.14.106","v4.14.105","v4.14.104","v4.14.103","v4.14.102","v4.14.101","v4.14.100","v4.14.99","v4.14.98","v4.14.97","v4.14.96","v4.14.95","v4.14.94","v4.14.93","v4.14.92","v4.14.91","v4.14.90","v4.14.89","v4.14.88","v4.14.87","v4.14.86","v4.14.85","v4.14.84","v4.14.83","v4.14.82","v4.14.81","v4.14.80","v4.14.79","v4.14.78","v4.14.77","v4.14.76","v4.14.75","v4.14.74","v4.14.73","v4.14.72","v4.14.71","v4.14.70","v4.14.69","v4.14.68","v4.14.67","v4.14.66","v4.14.65","v4.14.64","v4.14.63","v4.14.62","v4.14.61","v4.14.60","v4.14.59","v4.14.58","v4.14.57","v4.14.56","v4.14.55","v4.14.54","v4.14.53","v4.14.52","v4.14.51","v4.14.50","v4.14.49","v4.14.48","v4.14.47","v4.14.46","v4.14.45","v4.16.18","v4.16.17","v4.16.16","v4.16.15","v4.16.14","v4.16.13"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98080.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.45"},{"fixed":"4.15"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.16.13"},{"fixed":"4.17"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.17.0"},{"fixed":"5.10.271"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.222"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.189"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.158"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.111"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98080.json"}}],"schema_version":"1.9.2"}