Executive brief
A vulnerability was identified in the Linux kernel's Btrfs file system component. The issue involves a memory or resource leak that occurs when the system fails to process certain file operations (specifically 'inline extents'). Over time, such leaks can exhaust system resources, potentially leading to system instability or a denial-of-service condition where the system becomes unresponsive.
Technical details
A resource reservation leak exists in the Btrfs file system implementation within the Linux kernel. Specifically, in the `__cow_file_range_inline()` function (and its variants), the kernel fails to release reserved quota group (qgroup) data if it encounters an error while allocating a path or joining a transaction. This occurs because the error paths return early without calling `btrfs_qgroup_free_data()`. An attacker with local access could potentially trigger these error paths repeatedly to exhaust kernel memory or qgroup reservations, leading to a denial-of-service. The fix ensures that the `out` label is used to properly free reserved data and end transactions during these failure scenarios. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux kernel All versions prior to the fixed stable releases in February 2026
Timeline
- 2025-12-12: other: Patch authored by Filipe Manana
- 2026-02-11: patched: Patches committed to stable kernel trees
- 2026-03-18: advisory: CVE published by kernel.org and NVD
References
- https://git.kernel.org/stable/c/28768bd3abf9995a93f6e01bfce01c60622964dd
- https://git.kernel.org/stable/c/28b97fcbbf523779688e8de5fe55bf2dae3859f6
- https://git.kernel.org/stable/c/c1c050f92d8f6aac4e17f7f2230160794fceef0c
- https://git.kernel.org/stable/c/f3ee1732851aec6fe6b2cec2ef1b32d4e71d9913
- https://git.kernel.org/stable/c/f7156512c8166d385f574b9ec030479aa7b1e8c9