CVE-2026-90259 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
In that function, we round down the start position and round up the ending position.
But during the calculation of @len, we use "round_up(start + len, sectorsize)", which is the rounded up end position, not the rounded up length.
Which results a much larger length, and later we are still using "start + len", which is completely incorrect.
Fix it by declaring a local @aligned_start and @aligned_len and use them instead.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The btrfs file system in the Linux kernel contains a logic error within the quota group management subsystem that leads to incorrect resource accounting during data reservation release operations. Specifically, the vulnerability resides in the qgroup_free_reserved_data function, which is responsible for freeing reserved space associated with quota groups when write operations are completed or rolled back. The core technical flaw stems from an erroneous calculation of the length parameter used to determine how much disk space should be released back to the system's free pool. Instead of calculating the actual number of bytes being freed, the code incorrectly applies a rounding operation to the sum of the start position and the original length. This mathematical error results in a significantly inflated value for the length variable, which does not represent the true extent of the data range involved in the operation.
This miscalculation has direct implications for memory management and storage accounting within the btrfs file system. Because the calculated length is much larger than the actual amount of space being freed, subsequent operations that rely on this value to update internal bookkeeping structures will process an incorrect scope. The code subsequently uses the expression start plus len to determine boundaries or perform further adjustments, which compounds the error by referencing a position far beyond the intended end of the data range. This discrepancy can lead to quota groups reporting inaccurate usage statistics, potentially causing the file system to believe that more space is reserved than actually exists. In severe cases, this could result in false positive full-disk conditions where applications are denied write access because the quota subsystem incorrectly believes available space has been exhausted due to inflated reservation counts.
From a security and stability perspective, while this issue primarily manifests as a functional correctness bug rather than an exploitable memory corruption vulnerability, it falls under categories of logic errors that can lead to denial of service conditions through resource exhaustion or incorrect state management. The flaw aligns with CWE-682, which covers Incorrect Calculation vulnerabilities where the arithmetic operations do not yield the expected result due to improper handling of data types or logical flow. Furthermore, in the context of ATT&CK techniques related to impact and defense evasion, such inaccuracies can be leveraged indirectly if an attacker can trigger repeated allocations and frees to skew quota limits, potentially causing a denial of service by exhausting available write permissions for legitimate users without directly crashing the kernel memory allocator.
The resolution involves refactoring the calculation logic within qgroup_free_reserved_data to ensure that alignment operations are applied correctly to both start positions and lengths independently. By declaring local variables for aligned_start and aligned_len, the code now computes the correct boundaries before performing any arithmetic on them. This approach prevents the accidental addition of rounded values to unrounded offsets, thereby ensuring that the length parameter accurately reflects the number of sectors or bytes being freed. To mitigate this vulnerability in environments running affected kernel versions, administrators should apply the latest available security patches for their Linux distribution. Regularly updating the kernel ensures that these internal accounting mechanisms function as intended, maintaining accurate quota enforcement and preventing potential denial-of-service scenarios arising from incorrect space reservation tracking.