---
id: CVE-2026-98081
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

  do_zone_finish() clears BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE before finishing
  the zones
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

  do_zone_finish() clears BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE before finishing
  the zones. If call…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d70cbdda75da3f258118a558c087157e073229fb <
    36b9cdab44848f25879ca625275c92b007f84653
  - >-
    Linux >= d70cbdda75da3f258118a558c087157e073229fb <
    40370f02a1ca3760f8925ffcbe76eb4d91ea758d
  - >-
    Linux >= d70cbdda75da3f258118a558c087157e073229fb <
    e1b168a53174b385e3548bfbd079513b22ac240c
  - >-
    Linux >= d70cbdda75da3f258118a558c087157e073229fb <
    a18a6b93a2843b9d103d3456bbd4b3f90282a379
  - Linux 5.19
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:37.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98081'
references:
  - url: 'https://git.kernel.org/stable/c/36b9cdab44848f25879ca625275c92b007f84653'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/40370f02a1ca3760f8925ffcbe76eb4d91ea758d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a18a6b93a2843b9d103d3456bbd4b3f90282a379'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e1b168a53174b385e3548bfbd079513b22ac240c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.835Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

do_zone_finish() clears BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE before finishing
the zones. If call_zone_finish() then fails it returned early, leaving the
now inactive block group on fs_info->zone_active_bgs, leaking its
reference, the BTRFS_FS_NEED_ZONE_FINISH waiters are never woken, and as
its alloc_offset equals the zone capacity btrfs_zone_finish_one_bg() keeps
selecting it, spinning btrfs_zoned_activate_one_bg().

Fall through to the cleanup on failure too and return the error, but keep
the block group read-only as its zones are left inconsistent.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.