CVE-2026-98091

The bug is a use‑after‑free in the Btrfs filesystem driver that occurs when creating the first metadata chunk for a sprout filesystem. If a subsequent system chunk creation fails, the code aborts the transaction and releases the device while it remains on the transaction update list, leaving the list pointing to freed memory. This condition can trigger a kernel memory corruption, which may allow an attacker with sufficient privileges to execute arbitrary code in kernel mode. The weakness is a classic use‑after‑free (CWE‑416).

All Linux kernel releases that include Btrfs support for sprout filesystems are affected. No specific version information is listed in the available data.

The EPSS score of < 1% indicates very low reported exploitation probability, and the CVSS score of 5.5 grades the vulnerability as medium severity. It is not listed in the CISA KEV catalog, so no public exploit is documented yet. The kernel‑level nature of the bug suggests a successful exploit would grant privilege escalation but the low exploitation probability mitigates immediate risk. The likely attack vector is local and would require an attacker to exercise privileged control over sprout filesystem operations to trigger the failure path.