Executive brief
A Btrfs filesystem quota group (qgroup) function contains an arithmetic error that miscalculates memory region boundaries when releasing reserved disk space. This causes the system to operate on incorrect address ranges when managing quota limits, potentially leading to incorrect accounting of reserved disk space or memory access violations.
Technical details
The vulnerability is a logic error in the qgroup_free_reserved_data() function within the Btrfs subsystem. The function incorrectly calculates the length of an aligned memory range by using round_up(start + len, sectorsize) as the length instead of computing it as the difference between the rounded end position and rounded start position. This results in a much larger, incorrect length value being used in subsequent range checks. The bug affects only code paths that call qgroup_free_reserved_data() with quota reservation management, requiring local filesystem access. The fix introduces aligned_start and aligned_len local variables to properly calculate boundaries.
Affected products
- Linux Linux kernel versions prior to fix (2026-07-28 upstream, 2026-09-14 stable)
Timeline
- 2026-09-17: disclosed
- 2026-07-28: patched: upstream commit 9102b179512e11644fb0489ae62010a09afa199c
- 2026-09-14: patched: stable kernel backport