CVE-2026-98907
Published Oct 23, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 ("btrfs: sync read disk super and set block size"). Take the mapping invalidate lock around read_cache_page_gfp() to serialize the read against block size changes.
Is your site exposed to CVE-2026-98907?
Run a free security scan — no signup, results in seconds.
References
Other References
https://git.kernel.org/stable/c/123b9a545f4d0348e81f558a032bf2a93ee5722f
https://git.kernel.org/stable/c/1a6c92aa7242a04e4349c0ea213dbf703a1c9891
https://git.kernel.org/stable/c/80cd97c5e90096d040a623851795eac92fbd0ff1
https://git.kernel.org/stable/c/a0dc28359a8a26f970ccd250b126a2e0bd4118a5
https://git.kernel.org/stable/c/a58cab4535f085adc0f93d7efd7952ef437371da
https://git.kernel.org/stable/c/c9b38f2eab5a9bd74087390318d93ccdd8d2deff
Frequently Asked Questions
What is CVE-2026-98907? +
In the Linux kernel, the following vulnerability has been resolved:
btrfs: protect sb_write_pointer() with invalidate lock
sb_write_pointer() reads the super block from the block device page cache
using read_cache_page_gfp(). This has the same race with BLKBSZSET as the
one fixed by commit 3f29d661e568 ("btrfs: sync read disk super and set
block size").
Take the mapping invalidate lock around read_cache_page_gfp() to
serialize the read against block size changes.
How do I check if I'm vulnerable to CVE-2026-98907? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.