CVE-2026-98080

Executive Summary

CVE-2026-98080 is a Linux kernel btrfs filesystem vulnerability in the function qgroup_account_snapshot() where relocation root creation is forcibly triggered during snapshot accounting. This causes a kernel warning in lookup_inline_extent_backref and flips the filesystem to read-only, resulting in a denial-of-service condition. Systems using btrfs with quota groups (qgroups) enabled and performing snapshot operations under relocation are affected, with impact limited to local availability loss and filesystem inconsistency requiring remount or reboot.

Technical Analysis

The vulnerability resides in the btrfs quota group (qgroup) accounting path, specifically within qgroup_account_snapshot(). The NVD description states that the fix prevents forcing relocation root creation during this accounting operation. The reported bug manifests when running btrfs/252 with quota enabled via MKFS_OPTIONS="-O quota". The kernel warning occurs in lookup_inline_extent_backref+0x74b/0x960 [btrfs] at fs/btrfs/extent-tree.c:879, followed by a stack trace showing the call chain:

• lookup_inline_extent_backref
• insert_inline_extent_backref
• __btrfs_inc_extent_ref
• __btrfs_run_delayed_refs
• btrfs_run_delayed_refs
• create_pending_snapshot
• create_pending_snapshots
• btrfs_commit_transaction
• prepare_to_relocate

The warning flips the filesystem to read-only (RO). The underlying mechanism appears to be an incorrect assumption or forced state transition during snapshot creation when relocation is in progress. Relocation root creation should not be required or forced during qgroup account snapshot, and doing so violates internal consistency checks in extent backref lookup. The exact code-level trigger (e.g., specific reference count mismatch or tree state) is not fully detailed in the available description; however, the crash is deterministic under the test conditions, indicating a reachable assertion (CWE-617). The affected component is the btrfs kernel module, and exploitation requires local access with the ability to create snapshots and trigger relocation, typically as a privileged user (root or CAP_SYS_ADMIN in a user namespace where btrfs is mounted).

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-98080. The attack chain is inferred from the vulnerability class (reachable assertion leading to filesystem read-only) and the NVD description.

1. Reconnaissance / Target Identification: An attacker with local access to a system where btrfs is used with quota groups enabled (-O quota) identifies mount points that support snapshots and relocation. This is common in container hosts, virtual machine images, and systems using btrfs subvolumes.

2. Triggering the Flaw: The attacker performs operations that cause a snapshot creation while a block group relocation is in progress. Specifically, invoking btrfs balance or relocation operations concurrently with snapshot creation (e.g., via btrfs subvolume snapshot) can trigger the path leading to qgroup_account_snapshot() forcing relocation root creation. The exact race or sequence is not detailed, but the bug report indicates it reproduces with the btrfs/252 test when quota is enabled.

3. Payload / Execution Method: The attacker executes standard btrfs management commands (e.g., btrfs balance start, btrfs subvolume snapshot) that are available to users with appropriate privileges. No custom payload is required; the vulnerability is triggered by legitimate filesystem operations under specific conditions.

4. Post-Exploitation Impact: The kernel warning triggers a filesystem read-only transition. All write operations to that filesystem fail, causing service disruption, data loss for in-flight writes, and potential application crashes. The system may require a reboot or filesystem repair (btrfs check) to restore normal operation. This is a denial-of-service condition, not a privilege escalation or remote code execution.

Impact Assessment

The CVSS v3.1 vector (inferred) is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H with a base score of 5.5 (Medium). The attack requires local access and low privileges (e.g., a user with the ability to execute btrfs commands, often root or a user with CAP_SYS_ADMIN). The impact is limited to availability: the filesystem becomes read-only, disrupting all services that depend on write access. Confidentiality and integrity are not directly impacted, but data loss may occur for pending writes. The blast radius includes any system using btrfs with qgroups enabled and performing snapshot/relocation operations. This includes container hosts, database servers, and backup systems. The vulnerability is not remotely exploitable and does not lead to code execution or privilege escalation. EPSS score is not yet available from FIRST.org, and CISA KEV does not list this CVE.

Detection Guidance

Sigma Rule

title: Btrfs Kernel Warning - lookup_inline_extent_backref
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects kernel warning in btrfs extent-tree.c related to CVE-2026-98080
author: Threat Intelligence
date: 2026-05-15
logsource:
    product: linux
    service: kernel
detection:
    keywords:
        - 'WARNING: fs/btrfs/extent-tree.c'
        - 'lookup_inline_extent_backref'
        - 'qgroup_account_snapshot'
    condition: keywords
falsepositives:
    - Unrelated btrfs warnings
level: high

YARA Rule

rule CVE_2026_98080_btrfs_warning
{
    meta:
        description = "Detects kernel log entries for CVE-2026-98080 btrfs warning"
        author = "Threat Intelligence"
        date = "2026-05-15"
        reference = "CVE-2026-98080"
    strings:
        $s1 = "WARNING: fs/btrfs/extent-tree.c:879"
        $s2 = "lookup_inline_extent_backref"
        $s3 = "qgroup_account_snapshot"
    condition:
        any of them
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-98080 Btrfs Kernel Warning Detected"; content:"WARNING: fs/btrfs/extent-tree.c"; content:"lookup_inline_extent_backref"; classtype:attempted-dos; sid:1000001; rev:1;)

Note: This rule is for detecting the warning message in network-transmitted logs (e.g., syslog). For local detection, host-based rules are more appropriate.

Elastic Detection

process where event.type == "start" and process.name in ("btrfs", "mkfs.btrfs") and process.args : ("balance", "subvolume snapshot") and process.args : "quota"

This EQL rule detects execution of btrfs commands that could trigger the vulnerability when quota is enabled.

Splunk SPL Query

index=linux sourcetype=syslog "WARNING: fs/btrfs/extent-tree.c" OR "lookup_inline_extent_backref" OR "qgroup_account_snapshot"
| stats count by host, _time
| where count > 0

Wazuh OSSEC Rule

<group name="linux,btrfs,">
  <rule id="100100" level="12">
    <decoded_as>syslog</decoded_as>
    <match>WARNING: fs/btrfs/extent-tree.c</match>
    <description>CVE-2026-98080: Btrfs kernel warning in extent-tree.c</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
  <rule id="100101" level="12">
    <decoded_as>syslog</decoded_as>
    <match>lookup_inline_extent_backref</match>
    <description>CVE-2026-98080: Btrfs lookup_inline_extent_backref warning</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable btrfs quota groups if not required: btrfs quota disable /mountpoint.
   • Avoid running balance/relocation operations concurrently with snapshot creation.
   • Monitor kernel logs for the warning string and alert on occurrences.
   • If the filesystem flips to read-only, remount or reboot to restore write access, and run btrfs check to verify integrity.

2. Patch/Upgrade Steps:

   • No official patch is available from tracked sources. Monitor the Linux kernel stable mailing list and btrfs development channels for a fix.
   • Once a patch is released, apply the kernel update via your distribution's package manager (e.g., apt upgrade linux-image-*, yum update kernel).
   • Consider using a distribution kernel with backported fixes when available.

3. Long-Term Hardening:

   • Evaluate whether btrfs quota groups are necessary for your use case; if not, keep them disabled.
   • Implement filesystem monitoring to detect read-only transitions and automatically alert.
   • Restrict local access to btrfs management commands to trusted administrators only.
   • Regularly run btrfs scrub and btrfs check to detect early filesystem inconsistencies.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98080
• Linux kernel btrfs documentation: https://btrfs.readthedocs.io/
• Btrfs test suite (btrfs/252): https://github.com/kdave/btrfs-progs
• CWE-617: Reachable Assertion: https://cwe.mitre.org/data/definitions/617.html
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.