ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-97416

btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()

Published Sep 24, 2026 · catalog updated Oct 24, 2026 · btrfs: balance: fix potential

Last checked Oct 25, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-97416. EPSS is 0.17%. Act only if a listed version of btrfs: balance: fix potential is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (btrfs: balance: fix potential).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.17%
Remediation
Advisory link
Affected products
Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() [BUG] Running btrfs balance can trigger a null-ptr-deref before relocating a data chunk when metadata corruption leaves a chunk in the chunk tree without a corresponding block group in the in-memory cache: KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] RIP: 0010:btrfs_may_alloc_data_chunk+0x40/0x1c0 fs/btrfs/volumes.c:3601 Call Trace: __btrfs_balance fs/btrfs/volumes.c:4217 [inline] btrfs_balance+0x2516/0x42b0 fs/btrfs/volumes.c:4604 btrfs_ioctl_balance fs/btrfs/ioctl.c:3577 [inline] btrfs_ioctl+0x25cf/0x5b90 fs/btrfs/ioctl.c:5313 ... [CAUSE] __btrfs_balance() iterates the on-disk chunk tree and passes the chunk logical bytenr to btrfs_may_alloc_data_chunk() before relocating a data chunk. That helper then queries the in-memory block group cache: cache = btrfs_lookup_block_group(fs_info, chunk_offset); chunk_type = cache->flags; /* cache may be NULL */ A corrupt image can contain a chunk item whose matching block group item is missing, so no block group is ever inserted into the cache. In that case btrfs_lookup_block_group() returns NULL. The code only guards this with ASSERT(cache), which becomes a no-op when CONFIG_BTRFS_ASSERT is disabled. The subsequent dereference of cache->flags therefore crashes the kernel. [FIX] Add a NULL check after btrfs_lookup_block_group() in btrfs_may_alloc_data_chunk() and print and error message for clarity.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Linux Kernel4.16.0 → 5.10.271; 5.11.0 → 5.15.222; 5.16.0 → 6.1.189

How to fix CVE-2026-97416

  • Upgrade

    CVE-2026-97416 lists a fix boundary at 5.10.271. Compare the installed build with that boundary before you change production.

  • Version check

    Seen in 4.16.0 → 5.10.271; 5.11.0 → 5.15.222; 5.16.0 → 6.1.189

  • Advisory

    Open the cve_org record and follow its fix.

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-97416. EPSS is 0.17%. Act only if a listed version of btrfs: balance: fix potential is installed.

Which versions are affected?

Compare what you have installed with Kernel 4.16.0 → 5.10.271; 5.11.0 → 5.15.222; 5.16.0 → 6.1.189. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.17%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 24, 2026 · OpenSSF OSV / OSV Scanner

    Detected

    In the Linux kernel, the following vulnerability has been resolved: btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() [BUG] Running btrfs balance can trigger a null-ptr-deref before relocating a data chunk when metadata corruption leaves a chunk in the chunk tree without a corresponding block group in the in-memory cache: KASAN: null-ptr-deref in range [0x000000000000

  2. Oct 24, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 5.10.271; Kernel fixed in 5.15.222; Kernel fixed in 6.1.189; Kernel fixed in 6.6.158

  3. Oct 24, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 5.10.271; 5.11.0

  4. Oct 24, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    In the Linux kernel, the following vulnerability has been resolved: btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() [BUG] Running btrfs balance can trigger a null-ptr-deref before relocating a data chunk when metadata corruption leaves a chunk in the chunk tree without a corresponding block group in the in-memory cache: KASAN: null-ptr-deref in range [0x000000000000

Sources

References

Freshness

Last verified in this catalog Oct 25, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • OpenSSF OSV / OSV ScannerOct 25, 2026
  • CVE.orgOct 24, 2026