Description
In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

do_zone_finish() clears BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE before finishing
the zones. If call_zone_finish() then fails it returned early, leaving the
now inactive block group on fs_info->zone_active_bgs, leaking its
reference, the BTRFS_FS_NEED_ZONE_FINISH waiters are never woken, and as
its alloc_offset equals the zone capacity btrfs_zone_finish_one_bg() keeps
selecting it, spinning btrfs_zoned_activate_one_bg().

Fall through to the cleanup on failure too and return the error, but keep
the block group read-only as its zones are left inconsistent.
Published: 2026-09-25
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

The Linux kernel bug causes a failure in the Btrfs zoned finish routine. If call_zone_finish() fails, the active block group remains listed in zone_active_bgs, leaving a leaked reference and preventing waiting threads from being notified. Because the block group stays read‑only and its zone state is inconsistent, the allocation paths spin in btrfs_zoned_activate_one_bg, which can block further file‑system activity.

Affected Systems

Linux kernel builds that include Btrfs with zoned support are affected. No specific kernel version is cited in the CNA data, so any kernel where Btrfs is compiled with zone support may be vulnerable.

Risk and Exploitability

There is no CVSS score or EPSS information available, and the vulnerability is not listed in the CISA KEV catalog. The description indicates that a failure during zone finalization can lead to a file‑system hang. No remote exploitation vector is disclosed, so the likelihood of exploitation is unclear, though the potential impact is a denial of service if the error path is triggered.

Generated by OpenCVE AI on September 25, 2026 at 16:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Linux kernel release that incorporates the Btrfs zoned finish fix, identified in the kernel commit history.
  • If an immediate kernel upgrade is not possible, reboot the system to clear any remaining active block groups and avoid paths that trigger zone_finish during the vulnerable period.
  • Monitor kernel logs for btrfs errors relating to zone_finish failures and schedule a maintenance window to apply the patch when such events are observed.

Generated by OpenCVE AI on September 25, 2026 at 16:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665
CWE-668

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if call_zone_finish() fails do_zone_finish() clears BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE before finishing the zones. If call_zone_finish() then fails it returned early, leaving the now inactive block group on fs_info->zone_active_bgs, leaking its reference, the BTRFS_FS_NEED_ZONE_FINISH waiters are never woken, and as its alloc_offset equals the zone capacity btrfs_zone_finish_one_bg() keeps selecting it, spinning btrfs_zoned_activate_one_bg(). Fall through to the cleanup on failure too and return the error, but keep the block group read-only as its zones are left inconsistent.
Title btrfs: zoned: finish active block group cleanup if call_zone_finish() fails
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T10:24:18.091Z

Reserved: 2026-09-25T10:19:56.075Z

Link: CVE-2026-98081

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:37.573

Modified: 2026-09-25T11:17:37.573

Link: CVE-2026-98081

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T16:15:16Z

Weaknesses
  • CWE-665

    Improper Initialization

  • CWE-668

    Exposure of Resource to Wrong Sphere