UBUNTU-CVE-2026-98279: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enableverity() hits the qgroup limit, rollbackverity() needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesystem is forced read-only even though the qgroup limit was for one subvolume only. Also orphan cleanup at the next mount fails the same way, so the leftover items are never removed: with -EDQUOT the subvolume stays unreachable, and with -ENOSPC on a full filesystem the next read-write mount fails. Start transactions with btrfsstarttransactionfallbackglobalrsv() in btrfsorphancleanup(), dropverityitems() and rollbackverity(). Those calls only delete items and free the space in the end, so they may use the global reserve and skip the qgroup limit, which avoids -ENOSPC and -EDQUOT.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using Btrfs on the listed Ubuntu kernel packages are exposed when filesystem verity is enabled and a qgroup limit or metadata-space exhaustion occurs during verity enablement or cleanup.
What conditions trigger the failure?
The issue is triggered when enable_verity() reaches a qgroup limit, or when insufficient metadata space prevents rollback or orphan cleanup. An attacker would need the ability to cause or participate in this local filesystem state; the CVSS vector indicates local access, low privileges, and no user interaction.
What is the operational impact if the issue occurs?
The filesystem can be forced read-only. Leftover verity items may also prevent cleanup on a later mount: a subvolume can remain unreachable after -EDQUOT, while -ENOSPC on a full filesystem can prevent a subsequent read-write mount.
What behavior does the fix change?
The fix uses the Btrfs global metadata reserve for rollback and orphan-cleanup transactions that only delete verity items. This lets cleanup proceed despite qgroup limits or lack of available metadata space, and the deletions free space afterward.