{"id":"CVE-2026-98959","summary":"btrfs: fix xattr replace when multiple xattrs are packed in the same item","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix xattr replace when multiple xattrs are packed in the same item\n\nIf we have a btrfs_dir_item item that packs multiple xattrs and then we\nreplace the value of one of them (with the setxattr(2) family of syscalls)\nwith another value of a different size, we end up not having a fully\ninitialized btrfs_dir_item, resulting in a corruption that the tree\nchecker will detect at extent buffer writeback time.\n\nThis is because in btrfs_setxattr() when we find a btrfs_dir_item with\nmultiple xattrs (due to the crc32c hash of their name being the same)\nwe delete one of the xattr items (btrfs_dir_item) and then insert a new\none, but the deletion and insertion results in shifting existing data in\nthe leaf and therefore when the new value of a xattr has a different size,\nthe new btrfs_dir_item is placed in a leaf section that was not\ninitialized and we only copy the value's data and set the value's length\nin the new btrfs_dir_item, without setting the name, the name's length,\nthe key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and\ntransaction ID.\n\nThe following script reproduces the issue:\n\n  $ cat test.sh\n  #!/bin/bash\n\n  DEV=/dev/sdi\n  MNT=/mnt/sdi\n\n  mkfs.btrfs -f $DEV\n  mount $DEV $MNT\n\n  touch $MNT/testfile\n\n  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their\n  # name and therefore are packed into the same btrfs_dir_item.\n  setfattr -n user.foobar -v 123 $MNT/testfile\n  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile\n\n  # Verify the xattrs are present.\n  echo \"xattrs before:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  # Now replace the value of the foobar xattr with a significantly larger\n  # value.\n  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile\n\n  # Check the xattrs have the expected values.\n  echo \"xattrs after:\"\n  getfattr --absolute-names --dump $MNT/testfile\n\n  umount $MNT\n\nRunning it:\n\n  $ ./test.sh\n  (...)\n  xattrs before:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n  user.foobar=\"123\"\n\n  xattrs after:\n  # file: /mnt/sdi/testfile\n  user.WvG1c1Td=\"qwerty\"\n\nSo the \"user.foobar\" xattr is missing and there was a transaction abort\nwhen unmounting the fs with the following traces in dmesg:\n\n  $ dmesg\n  [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964\n  [869800.159293] ------------[ cut here ]------------\n  [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179\n  [869800.168961] Modules linked in: btrfs dm_thin_pool (...)\n  [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G        W           7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)\n  [869800.193726] Tainted: [W]=WARN\n  [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n  [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]\n  [869800.198985] Code: 48 8b 7b 18 (...)\n  [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246\n  [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000\n  [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0\n  [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff\n  [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c\n  [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069\n  [869800.229097] FS:  00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000\n  [869800.231137] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0\n  [869800.233783] Call Trace:\n  [869800.234330]  \u003cTASK\u003e\n  [869800.234791]  read_extent_buffer+0x4d/0x100 [btrfs]\n  [869800.235898]  btrfs_listxattr+0x199/0x240 [btrfs]\n  [869800.236912]  vfs_listxattr+0x51/0\n---truncated---","modified":"2026-11-13T04:07:33.133562223Z","published":"2026-10-23T12:19:27.679Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98959.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/5877d7138cc4359d26fd7b010eedfd1b3162348f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7a53bb4668b319fc6c8a3ce2c21635125c7d2712"},{"type":"WEB","url":"https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a97114b9b00ed3d05156f3b2ddbf797296260389"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c1803697a60f22743aa28ad522f805e92d45e3f0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98959.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98959"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339"},{"fixed":"7a53bb4668b319fc6c8a3ce2c21635125c7d2712"},{"fixed":"5877d7138cc4359d26fd7b010eedfd1b3162348f"},{"fixed":"a97114b9b00ed3d05156f3b2ddbf797296260389"},{"fixed":"c1803697a60f22743aa28ad522f805e92d45e3f0"},{"fixed":"858bee1c77857aabcc2327cd32dd8266332de332"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"43f2e3615d181a7028ab797114c5960977669b2a"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a873146ce4fb025c0b5c1322af5a6bad042f5363"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"02590fd855d1690568b2fa439c942e933221b57a"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"55e97f654cbbbef70f9714f0e113604dd931e360"}]}],"versions":["v3.10.108","v3.10.107","v3.10.106","v3.10.105","v3.10.104","v3.10.103","v3.10.102","v3.10.101","v3.10.100","v3.10.99","v3.10.98","v3.10.97","v3.10.96","v3.10.95","v3.10.94","v3.10.93","v3.10.92","v3.10.91","v3.10.90","v3.10.89","v3.10.88","v3.10.87","v3.10.86","v3.10.85","v3.10.84","v3.10.83","v3.12.74","v3.12.73","v3.12.72","v3.12.71","v3.12.70","v3.12.69","v3.12.68","v3.12.67","v3.12.66","v3.12.65","v3.12.64","v3.12.63","v3.12.62","v3.12.61","v3.12.60","v3.12.59","v3.12.58","v3.12.57","v3.12.56","v3.12.55","v3.12.54","v3.12.53","v3.12.52","v3.12.51","v3.12.50","v3.12.49","v3.12.48","v3.12.47","v3.12.46","v3.12.45","v3.14.79","v3.14.78","v3.14.77","v3.14.76","v3.14.75","v3.14.74","v3.14.73","v3.14.72","v3.14.71","v3.14.70","v3.14.69","v3.14.68","v3.14.67","v3.14.66","v3.14.65","v3.14.64","v3.14.63","v3.14.62","v3.14.61","v3.14.60","v3.14.59","v3.14.58","v3.14.57","v3.14.56","v3.14.55","v3.14.54","v3.14.53","v3.14.52","v3.14.51","v3.14.50","v3.14.49","v3.14.48","v3.14.47","v3.18.140","v3.18.139","v3.18.138","v3.18.137","v3.18.136","v3.18.135","v3.18.134","v3.18.133","v3.18.132","v3.18.131","v3.18.130","v3.18.129","v3.18.128","v3.18.127","v3.18.126","v3.18.125","v3.18.124","v3.18.123","v3.18.122","v3.18.121","v3.18.120","v3.18.119","v3.18.118","v3.18.117","v3.18.116","v3.18.115","v3.18.114","v3.18.113","v3.18.112","v3.18.111","v3.18.110","v3.18.109","v3.18.108","v3.18.107","v3.18.106","v3.18.105","v3.18.104","v3.18.103","v3.18.102","v3.18.101","v3.18.100","v3.18.99","v3.18.98","v3.18.97","v3.18.96","v3.18.95","v3.18.94","v3.18.93","v3.18.92","v3.18.91","v3.18.90","v3.18.89","v3.18.88","v3.18.87","v3.18.86","v3.18.85","v3.18.84","v3.18.83","v3.18.82","v3.18.81","v3.18.80","v3.18.79","v3.18.78","v3.18.77","v3.18.76","v3.18.75","v3.18.74","v3.18.73","v3.18.72","v3.18.71","v3.18.70","v3.18.69","v3.18.68","v3.18.67","v3.18.66","v3.18.65","v3.18.64","v3.18.63","v3.18.62","v3.18.61","v3.18.60","v3.18.59","v3.18.58","v3.18.57","v3.18.56","v3.18.55","v3.18.54","v3.18.53","v3.18.52","v3.18.51","v3.18.50","v3.18.49","v3.18.48","v3.18.47","v3.18.46","v3.18.45","v3.18.44","v3.18.43","v3.18.42","v3.18.41","v3.18.40","v3.18.39","v3.18.38","v3.18.37","v3.18.36","v3.18.35","v3.18.34","v3.18.33","v3.18.32","v3.18.31","v3.18.30","v3.18.29","v3.18.28","v3.18.27","v3.18.26","v3.18.25","v3.18.24","v3.18.23","v3.18.22","v3.18.21","v3.18.20","v3.18.19"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98959.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.83"},{"fixed":"3.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.12.45"},{"fixed":"3.13"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.14.47"},{"fixed":"3.15"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.18.19"},{"fixed":"3.19"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.113"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.57"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98959.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}