CVE-2026-98907

In the Linux kernel, the following vulnerability has been resolved:

btrfs: protect sb write pointer() with invalidate lock

sb write pointer() reads the super block from the block device page cache using read cache page gfp(). This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 ("btrfs: sync read disk super and set block size").

Take the mapping invalidate lock around read cache page gfp() to serialize the read against block size changes.