CVE-2026-98079 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of systems that use btrfs with zstd compression should assess their exposure and verify if their systems are affected.

Why it matters

CVE-2026-98079 is a Linux kernel vulnerability that allows a writer to sleep indefinitely in zstd_get_workspace(). Linux kernel maintainers and users should assess exposure, verify system usage, and check for updated kernel versions or patches.

• Denial of service due to indefinite sleep in zstd_get_workspace().
• Potential system hang or unresponsiveness if the affected btrfs functionality is used with zstd compression.
• Verification of kernel versions and patches is necessary to ensure system security.
• Exposure assessment and system configuration review are required to determine potential impact.

Technical summary

The vulnerability is in the btrfs zstd workspace management. A writer can sleep indefinitely in zstd_get_workspace() if zstd_alloc_workspace() fails and the task is queued without re-checking the pool. The wakeup is lost if a max-level workspace is returned between the failed allocation and prepare_to_wait(). This issue arises when zstd_alloc_workspace() goes through kvmalloc() and may enter reclaim. The fix involves keeping a max level workspace allocated as a fallback and re-checking the pool after prepare_to_wait() has published the waiter.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify if their systems use the affected btrfs functionality with zstd compression. They should check for updated kernel versions or patches from their distribution.

Recommended defensive actions

• Review Linux kernel versions and distributions for available patches.
• Check if systems use btrfs with zstd compression.
• Verify system configurations and update kernel if necessary.
• Perform exposure review for systems using btrfs with zstd compression.
• Monitor relevant logs for systems using btrfs with zstd compression.
• Track exceptions and retest remediated assets.
• Plan vendor-supported updates or mitigations through normal change control.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. Three source references from the Linux kernel Git repository are available, explaining the fix for the issue. The vulnerability allows a writer to sleep indefinitely in zstd_get_workspace() if zstd_alloc_workspace() fails and the task is queued without re-checking the pool. A max-level workspace is kept allocated as a fallback, but if its wakeup is lost, the writer remains in TASK_UNINTERRUPTIBLE until another task returns one. The fix involves re-checking the pool

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.