CVE-2026-98083
Linux kernel: use-after-free
- Risk score
- 52/100
- CVSS
- 7.0 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM. btrfs_finish_one_ordered(), the production caller thro…
- Affected
- Linux kernel
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). The timer can expire and detach between these operations, causing timer_reduce() to rearm the timer without taking t…
The flaws
- CVE-2026-98083: Use-after-free (CVSS 7.0 · EPSS 0%)
- CVE-2026-98130: Race condition (CVSS 8.1 · EPSS 0%)
- CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
- CVE-2026-98052: In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last… (CVSS 7.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Linux kernel
Where it stands
- No known exploitation
Connects to
- Same weakness: Use-after-free (CWE-416). 400 other warnings in 30 days
- Same product: Earlier Linux kernel warnings. 61 in the last 90 days
Why it is Yellow
- CVSS 7.0 high
- On your watchlist: linux kernel
References
- https://git.kernel.org/stable/c/089d9c45ea49ffffe55a8fe08d0ce2536626e90a
- https://git.kernel.org/stable/c/2fbfd02bdfe12b20bd3cc7a3190fb32e3f7072f5
- https://git.kernel.org/stable/c/a8813a923f9e43f788b357fb55c35f7f6ed6f98c
- https://git.kernel.org/stable/c/b185bdf30313e213fa1c887fe22fc3d513c061d9
- https://git.kernel.org/stable/c/b7b94923b3b5774d85a2a7c8d6eb9e3e0ef66685
Original description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM. btrfs_finish_one_ordered(), the production caller through btrfs_insert_raid_extent(), still owns the transaction handle. It handles the error by aborting the transaction and then reaches the common exit path, which ends the transaction again. The premature end can free the handle and drop its transaction reference. Transaction cleanup can then free the transaction before the caller's second abort accesses the handle and transaction, resulting in use-after-free. Keep the abort at the failure site, but let the caller's common exit path end the transaction once, after it has finished using both objects.
Last activity 25 Sep 2026. Patch Forecast updates every hour.