All vulnerabilities
CVE-2026-98279

Linux: btrfs: handle lack of space when cleaning up verity items

Linux LinuxOperating systems
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4b7ecabd87dc40998fe7870d7975279649229a3bAlso 76bf149cd0298544631e756670b89c399c7acbcaCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4b7ecabd87dc40998fe7870d7975279649229a3bLinuxCVE List
  • 76bf149cd0298544631e756670b89c399c7acbcaLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: handle lack of space when cleaning up verity items

When enable_verity() hits the qgroup limit, rollback_verity() needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesystem is forced read-only even though the qgroup limit was for one subvolume only. Also orphan cleanup at the next mount fails the same way, so the leftover items are never removed: with -EDQUOT the subvolume stays unreachable, and with -ENOSPC on a full filesystem the next read-write mount fails.

Start transactions with btrfs_start_transaction_fallback_global_rsv() in btrfs_orphan_cleanup(), drop_verity_items() and rollback_verity(). Those calls only delete items and free the space in the end, so they may use the global reserve and skip the qgroup limit, which avoids -ENOSPC and -EDQUOT.

Text from CVE List

Affected versions 8

  • Linuxaffected: 146054090b0859b28fc39015c7704ccc3c3a347f before 4b7ecabd87dc40998fe7870d7975279649229a3bCVE List
  • Linuxaffected: 146054090b0859b28fc39015c7704ccc3c3a347f before efa5780b84f066f419a667f6b9542368b2f62074CVE List
  • Linuxaffected: 146054090b0859b28fc39015c7704ccc3c3a347f before 76bf149cd0298544631e756670b89c399c7acbcaCVE List
  • Linuxaffected: 5.15CVE List
  • Linuxunaffected: all versions before 5.15CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3