{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "02c372e1f016e5113217597ab37b399c4e407477"
            },
            {
              "fixed": "b185bdf30313e213fa1c887fe22fc3d513c061d9"
            },
            {
              "fixed": "2fbfd02bdfe12b20bd3cc7a3190fb32e3f7072f5"
            },
            {
              "fixed": "b7b94923b3b5774d85a2a7c8d6eb9e3e0ef66685"
            },
            {
              "fixed": "a8813a923f9e43f788b357fb55c35f7f6ed6f98c"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "ab69bf6f8970c09d3735c25094e9471d54365282"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.6.130"
            },
            {
              "fixed": "6.7"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.111"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.53"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98083.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix transaction use-after-free in raid stripe insertion\n\nIf allocation of a RAID stripe extent fails,\nbtrfs_insert_one_raid_extent() aborts and ends the transaction before\nreturning -ENOMEM.\n\nbtrfs_finish_one_ordered(), the production caller through\nbtrfs_insert_raid_extent(), still owns the transaction handle. It handles\nthe error by aborting the transaction and then reaches the common exit\npath, which ends the transaction again.\n\nThe premature end can free the handle and drop its transaction reference.\nTransaction cleanup can then free the transaction before the caller's\nsecond abort accesses the handle and transaction, resulting in\nuse-after-free.\n\nKeep the abort at the failure site, but let the caller's common exit path\nend the transaction once, after it has finished using both objects.",
  "id": "CVE-2026-98083",
  "modified": "2026-09-27T03:30:36.435245498Z",
  "published": "2026-09-25T10:24:19.287Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2fbfd02bdfe12b20bd3cc7a3190fb32e3f7072f5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a8813a923f9e43f788b357fb55c35f7f6ed6f98c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b185bdf30313e213fa1c887fe22fc3d513c061d9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b7b94923b3b5774d85a2a7c8d6eb9e3e0ef66685"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98083.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98083"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "btrfs: fix transaction use-after-free in raid stripe insertion"
}