{"id":"CVE-2026-68442","revision":"27c8b8d81fed4d41a3a0de24eb7c4908","records":[{"revision":"27c8b8d81fed4d41a3a0de24eb7c4908","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68442","aliases":[],"title":"btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps\n\nWhen btrfs_drop_extent_map_range() splits an extent map, the new split\nmaps inherit the original map's flags through a local 'flags' variable.\nCommit f86f7a75e2fb (\"btrfs: use the flags of an extent map to identify\nthe compression type\") changed the EXTENT_FLAG_LOGGING clearing to\noperate on em->flags instead of that local 'flags' copy, so a split of\nan extent map that is currently being logged wrongly inherits\nEXTENT_FLAG_LOGGING.\n\nThe flag is then never cleared on the split, and when it is freed while\nstill on the inode's modified_extents list (for example by the extent\nmap shrinker) it trips the WARN_ON(!list_empty(&em->list)) in\nbtrfs_free_extent_map() and leads to a use-after-free.\n\nClear EXTENT_FLAG_LOGGING from the local 'flags' copy used for the\nsplits and only clear EXTENT_FLAG_PINNED from em->flags, restoring the\nbehaviour prior to f86f7a75e2fb.","state":0,"publishedAt":"2026-08-12T00:07:31.981+00:00","modifiedAt":"2026-10-19T21:09:10.486+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/btrfs/extent_map.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9\",\n                            \"lessThan\": \"2a9246a424f45f33a1b8367052611ebe874868ad\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9\",\n                            \"lessThan\": \"9304713b70e7e1450e3a76e758836fe5391bfa95\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9\",\n                            \"lessThan\": \"0e465c63f103a5ce6849614d6bda048d70eebec8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9\",\n                            \"lessThan\": \"5eff4d5b17fa1950e80bfd1ba43dc0699e61a644\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/btrfs/extent_map.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/2a9246a424f45f33a1b8367052611ebe874868ad","https://git.kernel.org/stable/c/9304713b70e7e1450e3a76e758836fe5391bfa95","https://git.kernel.org/stable/c/0e465c63f103a5ce6849614d6bda048d70eebec8","https://git.kernel.org/stable/c/5eff4d5b17fa1950e80bfd1ba43dc0699e61a644"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68442","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68442","identifiers":["CVE-2026-68442"]},"retained":false,"historicalAffected":[]}],"coverage":[]}