rootpwn

medium · CVSS v3 5.5

CVE-2026-98079

This CVE affects the Linux kernel’s Btrfs filesystem when using Zstandard compression. A bug in workspace allocation can cause a writer thre

Overview

This CVE affects the Linux kernel’s Btrfs filesystem when using Zstandard compression. A bug in workspace allocation can cause a writer thread to sleep indefinitely, potentially blocking I/O operations. The issue is limited to kernel code and does not involve user input directly.

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: zstd: fix lost wakeup when waiting for a workspace A writer can sleep forever in zstd_get_workspace() even though a workspace is free. When zstd_alloc_workspace() fails, the task is queued on zwsm->wait and schedules unconditionally, never re-testing the pool. zstd_put_workspace() publishes the workspace and then calls cond_wake_up(), which only wakes when a sleeper is already visible, so a workspace returned between the failed allocation and prepare_to_wait() wakes nobody. The window is wide: zstd_alloc_workspace() goes through kvmalloc() and may enter reclaim. Only a max level workspace triggers the wakeup and one is deliberately kept allocated as the fallback every waiter waits for, so once its wakeup is lost the writer stays in TASK_UNINTERRUPTIBLE until some other task happens to return one. Re-check the pool after prepare_to_wait() has published the waiter, and use the workspace if one turned up.

Impact

Confidentiality: none. Integrity: potential denial of service due to blocked writes. Availability: affected systems may experience stalled I/O, impacting performance and reliability. Defenders: kernel maintainers and system administrators.

Remediation

Apply the latest kernel update that includes the fix for CVE-2026-98079. If an update is not possible, disable Btrfs Zstandard compression or remount filesystems without compression. Monitor kernel logs for 'zstd_get_workspace' errors and ensure no long sleeps.

Risk context

Medium severity, CVSS 5.5, no EPSS data. While not critical, the potential for indefinite blocking warrants timely patching, especially on systems with high I/O workloads.

Affected products

  • Linux kernel
  • Btrfs
  • Ubuntu
  • Fedora
  • RedHat
  • Debian
  • CentOS
  • OpenSUSE

Scores

Severity
medium
CVSS v2
5.6
CVSS v3
5.5
CVSS v4
—
EPSS
—

kernel btrfs zstd denial-of-service sleep workspace patch availability

← All CVEs

Related CVEs

medium

CVE-2026-97869

LangChain4j up to 1.5.3-beta10, 1.11.10-beta18, and 1.18.1-beta27 contains a deserialization flaw in AgenticScopeSerializer.fromJson that can be triggered by crafted JSON when AgenticScope persistence is enabled, allowing remote code execution. The vulnerability is already published and exploitable by attackers who can write to the persistence store. Upgrading to the patched releases resolves the issue.

View analysis

medium

CVE-2026-97989

CVE-2026-97989 exposes a missing validation of virtqueue alignment in the Linux kernel, allowing a zero or non‑power‑of‑two alignment to reach virtio ring helpers and trigger a null‑pointer dereference. This flaw can cause kernel crashes when a virtio‑net device is opened, leading to service disruption. The issue is mitigated by ensuring proper alignment values before ring creation.

View analysis

medium

CVE-2026-97993

A flaw in the Linux kernel’s vhost‑vdpa driver allows a temporary invalid eventfd context to be used during configuration changes, potentially causing config interrupts to fail silently. The issue arises from a race window between swapping the context and clearing an error value. It affects systems running the vhost‑vdpa driver in the kernel.

View analysis

medium

CVE-2026-97994

The Linux kernel vhost-vdpa path accepted VHOST_SET_VRING_NUM values larger than the device maximum, allowing a local process with access to /dev/vhost-vdpa-* to configure an oversized virtqueue. With vdpa_sim, this can cause an out-of-bounds read in the vring IOTLB path. It matters because it can expose kernel memory or destabilize virtualized network/device workloads.

View analysis