CVE-2026-97416 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of the btrfs file system, should be aware of this vulnerability and take steps to apply the provided patches. Linux kernel developers and users of the btrfs file system should apply patches to prevent potential DoS and data loss. This vulnerability can cause a kernel crash when running btrfs balance operations due to metadata corruption.

Why it matters

This vulnerability can cause a kernel crash when running btrfs balance operations due to metadata corruption. Linux kernel developers and users of the btrfs file system should apply patches to prevent potential DoS and data loss.

• Denial of Service (DoS) due to kernel crash
• Potential data loss or corruption if btrfs balance operations are interrupted

Technical summary

The vulnerability is caused by a null-pointer dereference in the btrfs_may_alloc_data_chunk function. This occurs when a chunk item in the on-disk chunk tree does not have a matching block group item in the in-memory cache, resulting in a NULL return from btrfs_lookup_block_group(). The code currently only checks for this condition with an ASSERT statement, which does not prevent the crash. To fix this issue, a NULL check has been added after btrfs_lookup_block_group() in btrfs_may_alloc_data_chunk(), and an error message is printed for clarity.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel's btrfs module.
• Ensure that the system's Linux kernel is updated with the latest security patches.
• Monitor the system's logs for any errors related to btrfs balance operations.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The vulnerability is caused by a null-pointer dereference in the btrfs_may_alloc_data_chunk function. This occurs when a chunk item in the on-disk chunk tree does not have a matching block group item in the in-memory cache, resulting in a NULL return from btrfs_lookup_block_group(). The code currently only checks for this condition with an ASSERT statement, which does not prevent the crash.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.