CVE-2026-98081

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

do_zone_finish() clears BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE before finishing

the zones. If call_zone_finish() then fails it returned early, leaving the

now inactive block group on fs_info->zone_active_bgs, leaking its

reference, the BTRFS_FS_NEED_ZONE_FINISH waiters are never woken, and as

its alloc_offset equals the zone capacity btrfs_zone_finish_one_bg() keeps

selecting it, spinning btrfs_zoned_activate_one_bg().

Fall through to the cleanup on failure too and return the error, but keep

the block group read-only as its zones are left inconsistent.