CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
In the Linux kernel, the following vulnerability has been resolved:
btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata()
In that function, we round down the start position and round up the ending position.
But during the calculation of @len, we use "roundup(start + len, sectorsize)", which is the rounded up end position, not the rounded up length.
Which results a much larger length, and later we are still using "start + len", which is completely incorrect.
Fix it by declaring a local @alignedstart and @alignedlen and use them instead.
Affected Software
Event History
Frequently Asked Questions
What kernel change should I look for when verifying remediation?
The referenced stable commits are e6edde29990af8064b9d12217ec03db231ccd55d, c4c136555ff90f1e2921cc42da43daac0ef9985e, and 9102b179512e11644fb0489ae62010a09afa199c. They correct the aligned start and length handling in btrfs qgroup_free_reserved_data().
Does the available information identify affected kernel versions?
No affected or fixed kernel version numbers are provided. Verification must therefore be based on whether the relevant fix commit is present rather than on a version number from this record.