CVE-2026-68442btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
- 7.8HighCVSS base score
- 0.15%Exploitation in 30 daysEPSS · top 96% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When btrfs_drop_extent_map_range() splits an extent map, the new split maps inherit the original map's flags through a local 'flags' variable. Commit f86f7a75e2fb ("btrfs: use the flags of an extent map to identify the compression type") changed the EXTENT_FLAG_LOGGING clearing to operate on em->flags instead of that local 'flags' copy, so a split of an extent map that is currently being logged wrongly inherits EXTENT_FLAG_LOGGING. The flag is then never cleared on the split, and when it is freed while still on the inode's modified_extents list (for example by the extent map shrinker) it trips the WARN_ON(!list_empty(&em->list)) in btrfs_free_extent_map() and leads to a use-after-free. Clear EXTENT_FLAG_LOGGING from the local 'flags' copy used for the splits and only clear EXTENT_FLAG_PINNED from em->flags, restoring the behaviour prior to f86f7a75e2fb.
Timeline
ID reserved
By Linux
- 13 days later
· 13 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.15% · top 96% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9 – < 2a9246a424f45f33a1b8367052611ebe874868ad
- affected f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9 – < 9304713b70e7e1450e3a76e758836fe5391bfa95
- affected f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9 – < 0e465c63f103a5ce6849614d6bda048d70eebec8
- affected f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9 – < 5eff4d5b17fa1950e80bfd1ba43dc0699e61a644
- affected 6.8
- unaffected < 6.8
- unaffected 6.12.101 – ≤ 6.12.*
- unaffected 6.18.42 – ≤ 6.18.*
- unaffected 7.1.6 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References4
- https://git.kernel.org/stable/c/2a9246a424f45f33a1b8367052611ebe874868ad (opens in a new tab)
- https://git.kernel.org/stable/c/9304713b70e7e1450e3a76e758836fe5391bfa95 (opens in a new tab)
- https://git.kernel.org/stable/c/0e465c63f103a5ce6849614d6bda048d70eebec8 (opens in a new tab)
- https://git.kernel.org/stable/c/5eff4d5b17fa1950e80bfd1ba43dc0699e61a644 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-57050 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-68442)Record last updated .