CVE-2026-98279 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
btrfs: handle lack of space when cleaning up verity items
When enable_verity() hits the qgroup limit, rollback_verity() needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesystem is forced read-only even though the qgroup limit was for one subvolume only. Also orphan cleanup at the next mount fails the same way, so the leftover items are never removed: with -EDQUOT the subvolume stays unreachable, and with -ENOSPC on a full filesystem the next read-write mount fails.
Start transactions with btrfs_start_transaction_fallback_global_rsv() in btrfs_orphan_cleanup(), drop_verity_items() and rollback_verity(). Those calls only delete items and free the space in the end, so they may use the global reserve and skip the qgroup limit, which avoids -ENOSPC and -EDQUOT.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel's Btrfs filesystem implementation contains a critical flaw related to quota group enforcement during verity metadata cleanup operations. This vulnerability arises specifically when the enable_verity function encounters a quota group limit while attempting to manage integrity verification items. The core issue lies in the rollback mechanism, where the rollback_verity routine fails to secure its own independent metadata reservation before proceeding with deletions. Consequently, if the system is constrained by either a strict quota group limit or general lack of available disk space, the cleanup process cannot complete successfully. This failure triggers an immediate and aggressive response from the filesystem driver, forcing the entire Btrfs volume into read-only mode to prevent further corruption or inconsistent states.
The operational impact of this flaw extends beyond simple service interruption during the initial event. Because the verity items are not properly removed due to the reservation error, subsequent maintenance tasks such as orphan cleanup also fail when the system is remounted with write permissions enabled. This creates a persistent state where leftover metadata items remain in the filesystem structure. If the failure occurs due to quota limits resulting in an EDQUOT error code, the affected subvolume becomes effectively unreachable and unusable for standard operations. In scenarios involving general disk space exhaustion leading to ENOSPC errors on subsequent read-write mounts, the entire mount operation may fail entirely, preventing access to any data stored within that filesystem instance until manual intervention or structural repairs are performed by an administrator.
From a technical classification perspective, this issue aligns with CWE-789: Memory Exhaustion and CWE-252: Unchecked Return Value, as the system fails to adequately handle resource allocation failures during critical cleanup routines. The behavior of forcing a read-only state upon encountering specific error codes can be viewed through the lens of availability risks associated with improper error handling in storage drivers. Furthermore, the persistence of orphaned items that block future mounts relates to CWE-20: Improper Input Validation regarding the internal consistency checks performed during mount operations. These flaws allow for denial-of-service conditions where legitimate users are locked out of their data due to rigid enforcement mechanisms that do not account for temporary resource constraints or isolated quota violations within specific subvolumes rather than global filesystem limits.
To mitigate this vulnerability, developers have implemented a change in transaction handling strategies by introducing btrfs_start_transaction_fallback_global_rsv calls into the orphan cleanup and verity item deletion routines. This modification allows these specific metadata operations to utilize the global reserve mechanism instead of being strictly bound by individual quota group limits during space allocation attempts. Since these transactions primarily involve deleting items and freeing up existing space rather than allocating new large blocks, they are less likely to exhaust critical resources immediately. By bypassing strict qgroup enforcement for cleanup tasks that ultimately restore balance to the filesystem, the system avoids triggering EDQUOT or ENOSPC errors that lead to read-only forcing or mount failures. This ensures that subvolumes remain accessible and that orphaned items are correctly purged during routine maintenance cycles, thereby preserving both data availability and structural integrity without requiring manual administrative intervention for every quota-related cleanup event.