CVE-2026-98279: btrfs: handle lack of space when cleaning up verity items
btrfs: handle lack of space when cleaning up verity items
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are affected in practice?
The issue applies to Linux systems using Btrfs with fs-verity operations, particularly where quota groups impose limits or filesystem metadata space is exhausted. A qgroup limit on a single subvolume can trigger filesystem-wide read-only behavior during failed verity cleanup.
What conditions trigger the failure?
The failure occurs when enable_verity() reaches a qgroup limit and its rollback cannot reserve metadata space. It can also occur when the filesystem is full, causing cleanup to fail with ENOSPC.
What is the operational impact if cleanup fails?
The filesystem can be forced read-only. After a restart, orphan cleanup may fail: with EDQUOT the affected subvolume remains unreachable, and with ENOSPC a subsequent read-write mount can fail.
What change resolves the problem?
The fix uses btrfs_start_transaction_fallback_global_rsv() for orphan cleanup and verity-item rollback or deletion. This permits cleanup transactions to use the global reserve and bypass qgroup limits because the operations delete items and ultimately free space.