In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we… (CVE-2026-98959)

The vulnerability in the Linux kernel's Btrfs filesystem arises when a btrfs_dir_item packs multiple xattrs due to hash collisions. When one xattr's value is replaced with a differently sized value using setxattr(2) syscalls, the deletion and insertion process shifts data in the leaf node. However, the new btrfs_dir_item is placed in an uninitialized section of the leaf, and only partial fields (value data and length) are set, leaving critical fields like name, name length, key, flags, and transaction ID uninitialized. This leads to filesystem corruption detected by the tree checker during extent buffer writeback, causing transaction aborts and loss of the replaced xattr. The issue can be reproduced by adding two xattrs with colliding hashes and then replacing one with a larger value, resulting in the loss of that xattr and kernel warnings.

The vulnerability causes filesystem corruption in Btrfs when replacing extended attributes with differently sized values in certain conditions. This corruption triggers transaction aborts and can result in loss of extended attribute data. It may also cause kernel warnings and instability during filesystem operations involving xattrs. There is no indication of remote code execution or privilege escalation from the provided data.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to a kernel version that includes this fix to prevent filesystem corruption when modifying extended attributes in Btrfs. Since no vendor advisory or patch links are provided, check the Linux kernel release notes or trusted sources for the specific fixed version. Until patched, avoid replacing xattrs with differently sized values when multiple xattrs are packed in the same item.