{"cve":"CVE-2026-98091","nvd":{"published":"2026-09-25T11:17:38.807","modified":"2026-10-23T18:55:09.060","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: detach failed sprout device from transaction update list\n\nWhen creating the first metadata chunk for a sprout filesystem,\ncreate_chunk() adds the new device to the transaction dev_update_list\nthrough device->post_commit_list.\n\nIf the subsequent system chunk creation fails, btrfs_init_new_device()\naborts the transaction and releases the device while post_commit_list is\nstill linked. This triggers a warning in btrfs_free_device() and leaves\nthe transaction list referencing freed memory.\n\nDetach the device while holding chunk_mutex before releasing it.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/0ea6814bc0ff7cff443241bd34db9f0f828f3190","https://git.kernel.org/stable/c/2a57fb1d5ce8f316b81bbb60e6df245ebc816ffc","https://git.kernel.org/stable/c/63bfa52eb3289517aa82cb90e1189385873aae21","https://git.kernel.org/stable/c/7fe9dfbca43464baa8f050447a4837587b18adec","https://git.kernel.org/stable/c/86eff3052054e8f3b059b2d5845b6dcca021f20c"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-24T16:53:35.584907681+00:00"},"epss":{"cve":"CVE-2026-98091","score":0.00123,"percentile":0.02013,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}