CVE-2026-68442
btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When btrfs_drop_extent_map_range() splits an extent map, the new split maps inherit the original map's flags through a local 'flags' variable. Commit f86f7a75e2fb ("btrfs: use the flags of an extent map to identify the compression type") changed the EXTENT_FLAG_LOGGING clearing to operate on em->flags instead of that local 'flags' copy, so a split of an extent map that is currently being logged wrongly inherits EXTENT_FLAG_LOGGING. The flag is then never cleared on the split, and when it is freed while still on the inode's modified_extents list (for example by the extent map shrinker) it trips the WARN_ON(!list_empty(&em->list)) in btrfs_free_extent_map() and leads to a use-after-free. Clear EXTENT_FLAG_LOGGING from the local 'flags' copy used for the splits and only clear EXTENT_FLAG_PINNED from em->flags, restoring the behaviour prior to f86f7a75e2fb.
INFO
Published Date :
Aug. 12, 2026, 12:17 a.m.
Last Modified :
Aug. 12, 2026, 12:17 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-68442
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to a patched version.
- Ensure btrfs filesystem features are properly configured.
- Apply vendor-supplied security updates.
- Review btrfs extent map handling logic.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-68442.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-68442 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-68442
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-68442 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-68442 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 12, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9', 'lessThan': '2a9246a424f45f33a1b8367052611ebe874868ad', 'versionType': 'git'}, {'status': 'affected', 'version': 'f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9', 'lessThan': '9304713b70e7e1450e3a76e758836fe5391bfa95', 'versionType': 'git'}, {'status': 'affected', 'version': 'f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9', 'lessThan': '0e465c63f103a5ce6849614d6bda048d70eebec8', 'versionType': 'git'}, {'status': 'affected', 'version': 'f86f7a75e2fb5fd7d31d00eab8a392f97ba42ce9', 'lessThan': '5eff4d5b17fa1950e80bfd1ba43dc0699e61a644', 'versionType': 'git'}], 'programFiles': ['fs/btrfs/extent_map.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.8'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.8', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/btrfs/extent_map.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When btrfs_drop_extent_map_range() splits an extent map, the new split maps inherit the original map's flags through a local 'flags' variable. Commit f86f7a75e2fb ("btrfs: use the flags of an extent map to identify the compression type") changed the EXTENT_FLAG_LOGGING clearing to operate on em->flags instead of that local 'flags' copy, so a split of an extent map that is currently being logged wrongly inherits EXTENT_FLAG_LOGGING. The flag is then never cleared on the split, and when it is freed while still on the inode's modified_extents list (for example by the extent map shrinker) it trips the WARN_ON(!list_empty(&em->list)) in btrfs_free_extent_map() and leads to a use-after-free. Clear EXTENT_FLAG_LOGGING from the local 'flags' copy used for the splits and only clear EXTENT_FLAG_PINNED from em->flags, restoring the behaviour prior to f86f7a75e2fb. Added Reference https://git.kernel.org/stable/c/0e465c63f103a5ce6849614d6bda048d70eebec8 Added Reference https://git.kernel.org/stable/c/2a9246a424f45f33a1b8367052611ebe874868ad Added Reference https://git.kernel.org/stable/c/5eff4d5b17fa1950e80bfd1ba43dc0699e61a644 Added Reference https://git.kernel.org/stable/c/9304713b70e7e1450e3a76e758836fe5391bfa95