{"id":"CVE-2026-98269","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort transaction on failure to update inode for hole punching and reflinking\n\nIf we fail to update the inode we error out without aborting the\ntransaction, whic…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort transaction on failure to update inode for hole punching and reflinking\n\nIf we fail to update the inode we error out without aborting the\ntransaction, whic…","severity":"medium","vendor":"Linux","product":"Linux","affected":["Linux >= 2aaa66558172b017f36bf38ae69372813dedee9d < 2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d","Linux >= 2aaa66558172b017f36bf38ae69372813dedee9d < 834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6","Linux >= 2aaa66558172b017f36bf38ae69372813dedee9d < 9588850bfa75c78ce73c2f6f72544d19d2e9beb6","Linux >= 2aaa66558172b017f36bf38ae69372813dedee9d < 36c68dc909845c049e0286d229bc502947239452","Linux >= 2aaa66558172b017f36bf38ae69372813dedee9d < 97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","Linux 3.7"],"published":"2026-10-06","updated":"2026-10-06","sourceUpdated":"2026-10-06T09:18:16.353","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98269","references":[{"url":"https://git.kernel.org/stable/c/2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/36c68dc909845c049e0286d229bc502947239452","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9588850bfa75c78ce73c2f6f72544d19d2e9beb6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98269.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98269"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546382"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98269"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98269"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98269.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ingestedAt":"2026-10-06T08:50:17.423Z","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-390"],"epss":0.00168,"epssPercentile":0.06029,"slug":"CVE-2026-98269","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort transaction on failure to update inode for hole punching and reflinking\n\nIf we fail to update the inode we error out without aborting the\ntransaction, which can result in a persistent inconsistency if after\nthe failure the transaction is committed, as we have dropped file\nextent items from a range and either punched a hole or insert a new file\nextent item for that range (for reflinks).\n\nSo add the missing transaction abort.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 · updated 2026-10-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98269.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":219083,"id":"CVE-2026-98269","ts":1791707054441,"field":"cvss","old":null,"new":"5.5"},{"seq":219082,"id":"CVE-2026-98269","ts":1791707054441,"field":"severity","old":"none","new":"medium"}]}