{"id":"CVE-2026-98080","summary":"btrfs: do not force reloc root creation during qgroup_account_snapshot()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not force reloc root creation during qgroup_account_snapshot()\n\n[BUG]\nWhen running btrfs/252 with quota enabled through MKFS_OPTIONS=\"-O quota\",\nit has a high chance to trigger the following kernel warning and flips\nthe fs RO:\n\n  BTRFS info (device dm-2): relocating block group 30408704 flags metadata|dup\n  ------------[ cut here ]------------\n  WARNING: fs/btrfs/extent-tree.c:879 at lookup_inline_extent_backref+0x74b/0x960 [btrfs], CPU#4: btrfs/2173\n  CPU: 4 UID: 0 PID: 2173 Comm: btrfs Not tainted 7.2.0-rc6-custom+ #457 PREEMPT(full)  3adc6528fb66f7a55fe1095385818e742f200aab\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n  RIP: 0010:lookup_inline_extent_backref+0x74b/0x960 [btrfs]\n  Call Trace:\n   \u003cTASK\u003e\n   insert_inline_extent_backref+0x7c/0x160 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   __btrfs_inc_extent_ref+0xa9/0x270 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   __btrfs_run_delayed_refs+0x4af/0x11c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_run_delayed_refs+0x9d/0xf0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   create_pending_snapshot+0x39d/0xf00 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   create_pending_snapshots+0x9b/0xc0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_commit_transaction+0x280/0xeb0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   prepare_to_relocate+0x147/0x200 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   relocate_block_group+0x6b/0x5e0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_relocate_block_group+0x92c/0x2380 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_relocate_chunk+0x3f/0x1a0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_balance+0xa2c/0x19c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   btrfs_ioctl+0x2839/0x2d30 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]\n   __x64_sys_ioctl+0x416/0x9a0\n   do_syscall_64+0xe1/0x790\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u003c/TASK\u003e\n  ---[ end trace 0000000000000000 ]---\n  BTRFS info (device dm-2): leaf 4593991680 gen 233 total ptrs 175 free space 5953 owner 2\n  BTRFS info (device dm-2): refs 3 lock_owner 2173 current 2173\n  \titem 0 key (166772736 METADATA_ITEM 1) itemoff 16250 itemsize 33\n  \t\textent refs 1 gen 222 flags 2\n  \t\tref#0: tree block backref root 266\n         [ Skip the tree dump ]\n  \titem 174 key (263225344 METADATA_ITEM 0) itemoff 10328 itemsize 33\n  \t\textent refs 1 gen 162 flags 258\n  \t\tref#0: tree block backref root 267\n  BTRFS error (device dm-2): extent item not found for insert, bytenr 179847168 num_bytes 16384 parent 4594335744 root_objectid 273 owner 0 offset 0\n  BTRFS error (device dm-2): failed to run delayed ref for logical 179847168 num_bytes 16384 type 182 action 1 ref_mod 1: -117\n\n[CAUSE]\nThe above error is showing that there is a tree reference to a metadata\nextent that is no longer there.\n\nWith \"ref_verify\" mount option (requires CONFIG_BTRFS_DEBUG), there is\nsome extra debug output:\n\n  BTRFS error (device dm-2): dumping block entry [180961280 16384], num_refs 0, metadata 1, from disk 0\n  BTRFS error (device dm-2):   root entry 256, num_refs 18446744073709551615\n  BTRFS error (device dm-2):   root entry 273, num_refs 18446744073709551615\n  BTRFS error (device dm-2):   Ref action 3, root 273, ref_root 273, parent 0, owner 0, offset 0, num_refs 1\n     btrfs_force_cow_block+0x129/0x7d0 [btrfs]\n     btrfs_cow_block+0x10a/0x250 [btrfs]\n     btrfs_search_slot+0x5eb/0xf40 [btrfs]\n     btrfs_insert_empty_items+0x3a/0x70 [btrfs]\n     insert_with_overflow+0x53/0x130 [btrfs]\n     btrfs_insert_dir_item+0x125/0x290 [btrfs]\n     btrfs_add_link+0xaa/0x410 [btrfs]\n     btrfs_rename+0x5ea/0xcd0 [btrfs]\n     btrfs_rename2+0x28/0x60 [btrfs]\n     vfs_rename+0x5b2/0xe10\n     filename_renameat2+0x244/0x430\n     __x64_sys_rename+0x48/0x70\n     do_syscall_64+0xe1/0x790\n     entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \n---truncated---","modified":"2026-09-26T03:48:32.471027073Z","published":"2026-09-25T10:24:17.491Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98080.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/203cbfb4fba590bd9b08bd36fa6d05b5d28923bf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b5d5ab5a715001dd937c920ef8c5688fd4999ba1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c4c78768d1a8ceb713693cc5524acbe984c31f3c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cacf35832292997018837e484283f95a9301ebf5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98080.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98080"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4d31778aa2fa342f5f92ca4025b293a1729161d1"},{"fixed":"c4c78768d1a8ceb713693cc5524acbe984c31f3c"},{"fixed":"203cbfb4fba590bd9b08bd36fa6d05b5d28923bf"},{"fixed":"b5d5ab5a715001dd937c920ef8c5688fd4999ba1"},{"fixed":"cacf35832292997018837e484283f95a9301ebf5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0"},{"last_affected":"204bfcda824428b3a298eae8e87875bbd435a3c1"},{"last_affected":"1f586802bb18892d2a6eb7d31d7fed78946d21a1"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.14.45"},{"fixed":"4.15"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.16.13"},{"fixed":"4.17"}]}],"versions":["v4.16","v4.16.12","v4.14.44","v4.16.11","v4.14.43","v4.16.10","v4.14.42","v4.14.41","v4.16.9","v4.16.8","v4.14.40","v4.16.7","v4.14.39","v4.14.38","v4.16.6","v4.16.5","v4.14.37","v4.14.36","v4.16.4","v4.16.3","v4.14.35","v4.14.34","v4.16.2","v4.14.33","v4.16.1","v4.16-rc7","v4.16-rc4","v4.14.32","v4.16-rc1","v4.16-rc2","v4.16-rc5","v4.14.31","v4.14.30","v4.16-rc3","v4.16-rc6","v4.14.29","v4.14.28","v4.14.27","v4.14.26","v4.14.25","v4.14.24","v4.14","v4.14.23","v4.15","v4.14.22","v4.14.21","v4.14.20","v4.14.19","v4.14.18","v4.14.17","v4.15-rc1","v4.14.16","v4.15-rc4","v4.14.15","v4.15-rc9","v4.14.14","v4.15-rc8","v4.15-rc7","v4.14.13","v4.15-rc3","v4.15-rc2","v4.15-rc5","v4.15-rc6","v4.14.12","v4.14.11","v4.14.10","v4.14.9","v4.14.8","v4.14.7","v4.14.6","v4.14.5","v4.14.4","v4.14.3","v4.14.2","v4.14-rc1","v4.14.1","v4.14-rc7","v4.14-rc3","v4.13","v4.14-rc8","v4.14-rc4","v4.14-rc6","v4.14-rc2","v4.14-rc5","v4.13-rc2","v4.13-rc1","v4.13-rc3","v4.13-rc7","v4.13-rc4","v4.13-rc5","v4.13-rc6","v4.12-rc1","v4.12","v4.12-rc5","v4.12-rc7","v4.12-rc6","v4.12-rc4","v4.12-rc2","v4.12-rc3","v4.11","v4.11-rc1","v4.11-rc6","v4.11-rc8","v4.11-rc7","v4.11-rc3","v4.11-rc5","v4.11-rc2","v4.11-rc4","v4.10","v4.9","v4.10-rc8","v4.10-rc3","v4.10-rc1","v4.10-rc7","v4.10-rc6","v4.10-rc2","v4.10-rc5","v4.10-rc4","v4.9-rc7","v4.9-rc6","v4.9-rc8","v4.9-rc1","v4.9-rc5","v4.9-rc3","v4.9-rc4","v4.9-rc2","v4.8","v4.8-rc8","v4.8-rc2","v4.8-rc1","v4.8-rc7","v4.8-rc6","v4.8-rc5","v4.8-rc4","v4.8-rc3","v4.7","v4.7-rc4","v4.7-rc2","v4.7-rc1","v4.7-rc7","v4.7-rc6","v4.7-rc3","v4.7-rc5","v4.6","v4.6-rc1","v4.6-rc6","v4.6-rc4","v4.6-rc7","v4.6-rc5","v4.5-rc4","v4.6-rc2","v4.6-rc3","v4.5","v4.4","v4.5-rc1","v4.5-rc6","v4.5-rc2","v4.5-rc7","v4.5-rc5","v4.5-rc3","v4.4-rc1","v4.4-rc2","v4.4-rc8","v4.4-rc3","v4.4-rc7","v4.4-rc5","v4.4-rc6","v4.4-rc4","v4.3","v4.3-rc1","v4.3-rc6","v4.3-rc4","v4.3-rc2","v4.3-rc7","v4.3-rc5","v4.3-rc3","v4.2","v4.2-rc2","v4.2-rc1","v4.2-rc8","v4.2-rc4","v4.2-rc6","v4.2-rc7","v4.0-rc5","v4.2-rc5","v4.2-rc3","v4.1-rc2","v4.1","v4.1-rc1","v4.1-rc8","v4.1-rc7","v4.1-rc6","v4.1-rc3","v4.1-rc4","v4.0","v4.1-rc5","v4.0-rc1","v4.0-rc2","v4.0-rc7","v4.0-rc3","v4.0-rc6","v4.0-rc4","v3.19","v3.19-rc7","v3.19-rc5","v3.19-rc1","v3.19-rc6","v3.19-rc4","v3.18-rc1","v3.19-rc3","v3.19-rc2","v3.18","v3.18-rc7","v3.18-rc6","v3.18-rc2","v3.18-rc3","v3.18-rc4","v3.18-rc5","v3.17","v3.17-rc1","v3.17-rc7","v3.17-rc2","v3.17-rc4","v3.16","v3.17-rc5","v3.17-rc6","v3.17-rc3","v3.16-rc7","v3.16-rc1","v3.16-rc3","v3.16-rc5","v3.16-rc6","v3.16-rc2","v3.16-rc4","v3.13","v3.15","v3.15-rc5","v3.15-rc8","v3.15-rc1","v3.15-rc6","v3.15-rc3","v3.15-rc7","v3.15-rc2","v3.15-rc4","v3.14","v3.14-rc4","v3.14-rc8","v3.14-rc7","v3.14-rc6","v3.14-rc1","v3.14-rc2","v3.14-rc5","v3.14-rc3","v3.13-rc6","v3.13-rc8","v3.12","v3.13-rc7","v3.13-rc1","v3.13-rc4","v3.13-rc3","v3.13-rc5","v3.13-rc2","v3.12-rc7","v3.12-rc3","v3.12-rc6","v3.12-rc1","v3.12-rc5","v3.11","v3.12-rc2","v3.12-rc4","v3.11-rc7","v3.11-rc2","v3.11-rc5","v3.11-rc1","v3.11-rc3","v3.11-rc4","v3.11-rc6","v3.10-rc2","v3.10","v3.10-rc7","v3.10-rc6","v3.10-rc1","v3.10-rc5","v3.10-rc3","v3.10-rc4","v3.9","v3.9-rc2","v3.9-rc7","v3.9-rc8","v3.9-rc3","v3.9-rc6","v3.9-rc5","v3.9-rc4","v3.9-rc1","v3.8","v3.8-rc7","v3.8-rc6","v3.8-rc5","v3.8-rc2","v3.8-rc1","v3.8-rc3","v3.8-rc4","v3.7","v3.7-rc1","v3.6","v3.7-rc6","v3.7-rc7","v3.7-rc3","v3.7-rc8","v3.7-rc2","v3.7-rc4","v3.7-rc5","v3.6-rc7","v3.6-rc1","v3.5-rc3","v3.6-rc6","v3.6-rc5","v3.5","v3.6-rc3","v3.6-rc4","v3.6-rc2","v3.4-rc4","v3.5-rc7","v3.5-rc5","v3.5-rc6","v3.5-rc2","v3.5-rc1","v3.5-rc4","v3.4","v3.4-rc2","v3.4-rc1","v3.4-rc7","v3.4-rc6","v3.4-rc3","v3.4-rc5","v3.3","v3.3-rc6","v3.3-rc3","v3.3-rc7","v3.3-rc2","v3.3-rc5","v3.2","v3.3-rc4","v3.3-rc1","v3.2-rc4","v3.2-rc7","v3.2-rc6","v3.2-rc5","v3.2-rc3","v3.1","v3.2-rc2","v3.2-rc1","v3.1-rc1","v3.1-rc9","v3.1-rc8","v3.1-rc10","v3.1-rc7","v3.1-rc3","v3.1-rc2","v3.1-rc4","v3.1-rc5","v3.0","v3.1-rc6","v3.0-rc7","v3.0-rc4","v3.0-rc6","v3.0-rc5","v3.0-rc3","v3.0-rc1","v2.6.39","v3.0-rc2","v2.6.38","v2.6.39-rc2","v2.6.39-rc7","v2.6.39-rc5","v2.6.39-rc1","v2.6.38-rc7","v2.6.39-rc6","v2.6.39-rc4","v2.6.39-rc3","v2.6.37","v2.6.38-rc1","v2.6.38-rc8","v2.6.38-rc2","v2.6.38-rc6","v2.6.38-rc5","v2.6.38-rc4","v2.6.38-rc3","v2.6.37-rc4","v2.6.37-rc2","v2.6.36","v2.6.37-rc5","v2.6.37-rc8","v2.6.37-rc7","v2.6.37-rc6","v2.6.37-rc1","v2.6.37-rc3","v2.6.36-rc6","v2.6.35-rc4","v2.6.36-rc8","v2.6.35","v2.6.36-rc7","v2.6.36-rc3","v2.6.36-rc5","v2.6.36-rc4","v2.6.36-rc2","v2.6.36-rc1","v2.6.35-rc5","v2.6.35-rc6","v2.6.34","v2.6.35-rc3","v2.6.35-rc1","v2.6.35-rc2","v2.6.34-rc7","v2.6.34-rc6","v2.6.34-rc5","v2.6.34-rc4","v2.6.34-rc3","v2.6.34-rc2","v2.6.34-rc1","v2.6.33","v2.6.33-rc6","v2.6.33-rc8","v2.6.33-rc4","v2.6.33-rc5","v2.6.33-rc3","v2.6.33-rc7","v2.6.33-rc2","v2.6.32","v2.6.33-rc1","v2.6.32-rc8","v2.6.32-rc7","v2.6.32-rc6","v2.6.31","v2.6.32-rc5","v2.6.32-rc4","v2.6.32-rc2","v2.6.32-rc1","v2.6.32-rc3","v2.6.31-rc9","v2.6.31-rc1","v2.6.31-rc7","v2.6.31-rc8","v2.6.31-rc6","v2.6.30-rc6","v2.6.30","v2.6.31-rc4","v2.6.31-rc5","v2.6.31-rc3","v2.6.31-rc2","v2.6.30-rc7","v2.6.30-rc8","v2.6.30-rc5","v2.6.30-rc3","v2.6.30-rc4","v2.6.30-rc1","v2.6.30-rc2","v2.6.29","v2.6.29-rc8","v2.6.29-rc7","v2.6.29-rc5","v2.6.29-rc1","v2.6.29-rc6","v2.6.29-rc4","v2.6.29-rc3","v2.6.29-rc2","v2.6.28","v2.6.28-rc7","v2.6.28-rc9","v2.6.28-rc8","v2.6.28-rc6","v2.6.28-rc5","v2.6.28-rc4","v2.6.28-rc2","v2.6.28-rc3","v2.6.28-rc1","v2.6.27","v2.6.27-rc7","v2.6.27-rc9","v2.6.27-rc8","v2.6.27-rc5","v2.6.27-rc6","v2.6.27-rc4","v2.6.27-rc1","v2.6.27-rc3","v2.6.27-rc2","v2.6.26","v2.6.26-rc9","v2.6.26-rc8","v2.6.26-rc3","v2.6.26-rc7","v2.6.26-rc6","v2.6.26-rc5","v2.6.26-rc4","v2.6.26-rc2","v2.6.26-rc1","v2.6.25","v2.6.25-rc7","v2.6.25-rc9","v2.6.25-rc8","v2.6.25-rc6","v2.6.25-rc5","v2.6.25-rc3","v2.6.25-rc4","v2.6.24","v2.6.25-rc2","v2.6.25-rc1","v2.6.24-rc8","v2.6.24-rc7","v2.6.24-rc6","v2.6.24-rc5","v2.6.24-rc4","v2.6.24-rc3","v2.6.24-rc2","v2.6.24-rc1","v2.6.23","v2.6.23-rc9","v2.6.23-rc8","v2.6.23-rc5","v2.6.23-rc7","v2.6.23-rc6","v2.6.23-rc4","v2.6.23-rc3","v2.6.23-rc2","v2.6.23-rc1","v2.6.22","v2.6.22-rc7","v2.6.22-rc6","v2.6.22-rc5","v2.6.22-rc4","v2.6.22-rc3","v2.6.22-rc2","v2.6.22-rc1","v2.6.21","v2.6.21-rc7","v2.6.21-rc6","v2.6.21-rc5","v2.6.21-rc4","v2.6.21-rc3","v2.6.21-rc2","v2.6.21-rc1","v2.6.20-rc7","v2.6.20-rc6","v2.6.20-rc5","v2.6.20-rc4","v2.6.20-rc3","v2.6.20-rc1","v2.6.20-rc2","v2.6.19-rc2","v2.6.18","v2.6.19-rc1","v2.6.18-rc6","v2.6.18-rc5","v2.6.18-rc3","v2.6.18-rc2","v2.6.18-rc1","v2.6.17","v2.6.17-rc4","v2.6.17-rc6","v2.6.17-rc5","v2.6.17-rc3","v2.6.17-rc2","v2.6.17-rc1","v2.6.16","v2.6.16-rc6","v2.6.16-rc4","v2.6.16-rc5","v2.6.16-rc3","v2.6.16-rc2","v2.6.16-rc1","v2.6.15-rc7","v2.6.15-rc5","v2.6.15-rc4","v2.6.15-rc2","v2.6.15-rc1","v2.6.14-rc3","v2.6.14-rc2","v2.6.14-rc1","v2.6.13","v2.6.13-rc7","v2.6.13-rc6","v2.6.13-rc5","v2.6.13-rc3","v2.6.13-rc4","v2.6.13-rc2","v2.6.13-rc1","v2.6.12-rc4","v2.6.12-rc3","v2.6.12-rc2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98080.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.0"},{"fixed":"6.12.111"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98080.json"}}],"schema_version":"1.9.0"}