CVE-2026-98090

In the Linux kernel’s btrfs subsystem, the latest_dev pointer is not properly restored after a failed sprout operation. If chunk creation or the sprout setup fails, the new device is released while latest_dev still points to freed memory. A subsequent call to btrfs_show_devname dereferences this dangling pointer, causing a kernel crash that results in a denial‑of‑service condition.

All Linux distributions that ship a kernel containing the btrfs filesystem and that use the sprouting feature on btrfs volumes are affected. The vulnerability is present in any kernel version prior to the patch referenced in the advisory; exact version numbers are not specified in the advisory. The Git references indicate that a kernel commit after the listed changes contains the fix.

The flaw is a classic use‑after‑free in kernel space that can cause a panic. The CVSS score of 5.5 indicates medium severity, and the EPSS score of <1% suggests a low probability of exploitation. The likely attack vector is local or requires kernel‑level privileges; this is inferred from the description that the attacker must drive the sprout process to fail, which typically requires local access to perform btrfs operations. An attacker could, for example, force a chunk creation or sprout setup to fail through malformed I/O or resource exhaustion, leading to a crash. The vulnerability is not listed in the KEV catalog and the low EPSS score underscores a low likelihood of widespread exploitation. Still, any crash results in denial of service for the affected node, so patching is a priority.