CVE-2026-98079

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: zstd: fix lost wakeup when waiting for a workspace

A writer can sleep forever in zstd_get_workspace() even though a workspace

is free. When zstd_alloc_workspace() fails, the task is queued on

zwsm->wait and schedules unconditionally, never re-testing the pool.

zstd_put_workspace() publishes the workspace and then calls cond_wake_up(),

which only wakes when a sleeper is already visible, so a workspace returned

between the failed allocation and prepare_to_wait() wakes nobody. The

window is wide: zstd_alloc_workspace() goes through kvmalloc() and may

enter reclaim.

Only a max level workspace triggers the wakeup and one is deliberately kept

allocated as the fallback every waiter waits for, so once its wakeup is

lost the writer stays in TASK_UNINTERRUPTIBLE until some other task happens

to return one. Re-check the pool after prepare_to_wait() has published the

waiter, and use the workspace if one turned up.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References