CVE-2026-98279: btrfs: handle lack of space when cleaning up verity items

Published Oct 6, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

btrfs: handle lack of space when cleaning up verity items

When enableverity() hits the qgroup limit, rollbackverity() needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesystem is forced read-only even though the qgroup limit was for one subvolume only. Also orphan cleanup at the next mount fails the same way, so the leftover items are never removed: with -EDQUOT the subvolume stays unreachable, and with -ENOSPC on a full filesystem the next read-write mount fails.

Start transactions with btrfsstarttransactionfallbackglobalrsv() in btrfsorphancleanup(), dropverityitems() and rollbackverity(). Those calls only delete items and free the space in the end, so they may use the global reserve and skip the qgroup limit, which avoids -ENOSPC and -EDQUOT.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 6, 2026

CVE Published

via MITRE·08:45 AM

Data Sourced

via MITRE·08:45 AM

Description

Data Sourced

via NVD·09:18 AM

Description

Frequently Asked Questions

Which systems are affected in practice?

The issue applies to Linux systems using Btrfs with fs-verity operations, particularly where quota groups impose limits or filesystem metadata space is exhausted. A qgroup limit on a single subvolume can trigger filesystem-wide read-only behavior during failed verity cleanup.

What conditions trigger the failure?

The failure occurs when enable_verity() reaches a qgroup limit and its rollback cannot reserve metadata space. It can also occur when the filesystem is full, causing cleanup to fail with ENOSPC.

What is the operational impact if cleanup fails?

The filesystem can be forced read-only. After a restart, orphan cleanup may fail: with EDQUOT the affected subvolume remains unreachable, and with ENOSPC a subsequent read-write mount can fail.

What change resolves the problem?

The fix uses btrfs_start_transaction_fallback_global_rsv() for orphan cleanup and verity-item rollback or deletion. This permits cleanup transactions to use the global reserve and bypass qgroup limits because the operations delete items and ultimately free space.

CVE-2026-98279: btrfs: handle lack of space when cleaning up verity items

Affected Software

Event History

Frequently Asked Questions

Which systems are affected in practice?

What conditions trigger the failure?

What is the operational impact if cleanup fails?

What change resolves the problem?

Company

Resources

Contact

Frequently Asked Questions

Which systems are affected in practice?

What conditions trigger the failure?

What is the operational impact if cleanup fails?

What change resolves the problem?