Executive brief
A vulnerability was identified in the Linux kernel's Btrfs file system that could lead to incorrect data management when the system runs out of space. This issue occurs when the system fails to save small files directly into the file system's metadata and incorrectly releases reserved space that is still needed for alternative storage methods. This can potentially lead to file system inconsistencies or crashes, impacting system stability and data integrity.
Technical details
A logic error exists in the Btrfs file system's handling of inline extents within the Linux kernel. When `__cow_file_range_inline()` fails due to an -ENOSPC (No space left on device) error, the system attempts to fall back to the standard Copy-on-Write (COW) path. However, the code was unconditionally freeing reserved qgroup data even during this fallback, despite the data still being required for the subsequent COW operations. This results in a mismatch between reserved and used data accounting. The fix ensures that `btrfs_qgroup_free_data` is only called if the function is not proceeding with the fallback mechanism. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel Btrfs file system component
Timeline
- 2025-12-12: other: Patch authored
- 2026-03-18: disclosed: CVE published
- 2026-04-11: patched: Patches integrated into stable trees
References
- https://git.kernel.org/stable/c/0a1fbbd780f04d1b6cf48dd327c866ba937de1c4
- https://git.kernel.org/stable/c/3a9fd45afadec1fbfec72057b9473d509fa8b68c
- https://git.kernel.org/stable/c/3edd1f6c7c520536b62b2904807033597554dbac
- https://git.kernel.org/stable/c/6de3a371a8b9fd095198b1aa68c22cc10a4c6961
- https://git.kernel.org/stable/c/f8da41de0bff9eb1d774a7253da0c9f637c4470a