---
id: CVE-2026-98959
title: 'btrfs: fix xattr replace when multiple xattrs are packed in the same item'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: fix xattr replace when multiple xattrs are packed in the same item

  If we have a btrfs_dir_item item that packs multiple xattrs and then we
  replace the value of …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 <
    7a53bb4668b319fc6c8a3ce2c21635125c7d2712
  - >-
    Linux >= 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 <
    5877d7138cc4359d26fd7b010eedfd1b3162348f
  - >-
    Linux >= 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 <
    a97114b9b00ed3d05156f3b2ddbf797296260389
  - >-
    Linux >= 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 <
    c1803697a60f22743aa28ad522f805e92d45e3f0
  - >-
    Linux >= 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 <
    858bee1c77857aabcc2327cd32dd8266332de332
  - Linux 43f2e3615d181a7028ab797114c5960977669b2a
  - Linux a873146ce4fb025c0b5c1322af5a6bad042f5363
  - Linux 02590fd855d1690568b2fa439c942e933221b57a
  - Linux 55e97f654cbbbef70f9714f0e113604dd931e360
  - Linux >= 3.10.83 < 3.11
  - Linux >= 3.12.45 < 3.13
  - Linux >= 3.14.47 < 3.15
  - Linux >= 3.18.19 < 3.19
  - Linux 3.19
published: '2026-10-23'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:09:39.735Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98959'
references:
  - url: 'https://git.kernel.org/stable/c/7a53bb4668b319fc6c8a3ce2c21635125c7d2712'
  - url: 'https://git.kernel.org/stable/c/5877d7138cc4359d26fd7b010eedfd1b3162348f'
  - url: 'https://git.kernel.org/stable/c/a97114b9b00ed3d05156f3b2ddbf797296260389'
  - url: 'https://git.kernel.org/stable/c/c1803697a60f22743aa28ad522f805e92d45e3f0'
  - url: 'https://git.kernel.org/stable/c/858bee1c77857aabcc2327cd32dd8266332de332'
tags:
  - cve.org
epss: 0.00209
epssPercentile: 0.10479
ingestedAt: '2026-10-23T13:24:55.556Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix xattr replace when multiple xattrs are packed in the same item

If we have a btrfs_dir_item item that packs multiple xattrs and then we
replace the value of one of them (with the setxattr(2) family of syscalls)
with another value of a different size, we end up not having a fully
initialized btrfs_dir_item, resulting in a corruption that the tree
checker will detect at extent buffer writeback time.

This is because in btrfs_setxattr() when we find a btrfs_dir_item with
multiple xattrs (due to the crc32c hash of their name being the same)
we delete one of the xattr items (btrfs_dir_item) and then insert a new
one, but the deletion and insertion results in shifting existing data in
the leaf and therefore when the new value of a xattr has a different size,
the new btrfs_dir_item is placed in a leaf section that was not
initialized and we only copy the value's data and set the value's length
in the new btrfs_dir_item, without setting the name, the name's length,
the key (which must be all zeroes for xattrs), flags (BTRFS_FT_XATTR) and
transaction ID.

The following script reproduces the issue:

  $ cat test.sh
  #!/bin/bash

  DEV=/dev/sdi
  MNT=/mnt/sdi

  mkfs.btrfs -f $DEV
  mount $DEV $MNT

  touch $MNT/testfile

  # Add two xattrs that, on btrfs, have the same hash (crc32c) for their
  # name and therefore are packed into the same btrfs_dir_item.
  setfattr -n user.foobar -v 123 $MNT/testfile
  setfattr -n user.WvG1c1Td -v qwerty $MNT/testfile

  # Verify the xattrs are present.
  echo "xattrs before:"
  getfattr --absolute-names --dump $MNT/testfile

  # Now replace the value of the foobar xattr with a significantly larger
  # value.
  setfattr -n user.foobar -v abcdefghijklmnopqrstuvwxyz $MNT/testfile

  # Check the xattrs have the expected values.
  echo "xattrs after:"
  getfattr --absolute-names --dump $MNT/testfile

  umount $MNT

Running it:

  $ ./test.sh
  (...)
  xattrs before:
  # file: /mnt/sdi/testfile
  user.WvG1c1Td="qwerty"
  user.foobar="123"

  xattrs after:
  # file: /mnt/sdi/testfile
  user.WvG1c1Td="qwerty"

So the "user.foobar" xattr is missing and there was a transaction abort
when unmounting the fs with the following traces in dmesg:

  $ dmesg
  [869800.159271] BTRFS warning (device sdi): access to eb bytenr 30474240 len 16384 out of range start 16015 len 25964
  [869800.159293] ------------[ cut here ]------------
  [869800.159296] WARNING: fs/btrfs/extent_io.c:4408 at report_eb_range+0x44/0x60 [btrfs], CPU#8: getfattr/2605179
  [869800.168961] Modules linked in: btrfs dm_thin_pool (...)
  [869800.190527] CPU: 8 UID: 0 PID: 2605179 Comm: getfattr Tainted: G        W           7.3.0-rc3-btrfs-next-244+ #1 PREEMPT(full)
  [869800.193726] Tainted: [W]=WARN
  [869800.194502] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
  [869800.197576] RIP: 0010:report_eb_range+0x44/0x60 [btrfs]
  [869800.198985] Code: 48 8b 7b 18 (...)
  [869800.203531] RSP: 0018:ffffce4541937d58 EFLAGS: 00010246
  [869800.204609] RAX: 0000000000000000 RBX: ffff8dde054b8738 RCX: 0000000000000000
  [869800.206137] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc04c92a0
  [869800.207645] RBP: 0000000000003e8f R08: 0000000000000000 R09: 3fffffffffefffff
  [869800.226175] R10: ffffce4541937a88 R11: 0000000000000003 R12: 000000000000656c
  [869800.227594] R13: ffff8dde14be800f R14: 000000000000656c R15: 0000000000000069
  [869800.229097] FS:  00007f59023bb780(0000) GS:ffff8de5788ed000(0000) knlGS:0000000000000000
  [869800.231137] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [869800.232321] CR2: 0000558dc45e6a78 CR3: 0000000765b16004 CR4: 0000000000370ef0
  [869800.233783] Call Trace:
  [869800.234330]  <TASK>
  [869800.234791]  read_extent_buffer+0x4d/0x100 [btrfs]
  [869800.235898]  btrfs_listxattr+0x199/0x240 [btrfs]
  [869800.236912]  vfs_listxattr+0x51/0
---truncated---

## Affected

- `Linux >= 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 < 7a53bb4668b319fc6c8a3ce2c21635125c7d2712`
- `Linux >= 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 < 5877d7138cc4359d26fd7b010eedfd1b3162348f`
- `Linux >= 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 < a97114b9b00ed3d05156f3b2ddbf797296260389`
- `Linux >= 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 < c1803697a60f22743aa28ad522f805e92d45e3f0`
- `Linux >= 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 < 858bee1c77857aabcc2327cd32dd8266332de332`
- `Linux 43f2e3615d181a7028ab797114c5960977669b2a`
- `Linux a873146ce4fb025c0b5c1322af5a6bad042f5363`
- `Linux 02590fd855d1690568b2fa439c942e933221b57a`
- `Linux 55e97f654cbbbef70f9714f0e113604dd931e360`
- `Linux >= 3.10.83 < 3.11`
- `Linux >= 3.12.45 < 3.13`
- `Linux >= 3.14.47 < 3.15`
- `Linux >= 3.18.19 < 3.19`
- `Linux 3.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.