CVE-2026-98279

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: handle lack of space when cleaning up verity items

When enable_verity() hits the qgroup limit, rollback_verity() needs its

own metadata reservation. When the qgroup limit or lack of space refuses

the rollback, the whole filesystem is forced read-only even though the

qgroup limit was for one subvolume only. Also orphan cleanup at the next

mount fails the same way, so the leftover items are never removed: with

-EDQUOT the subvolume stays unreachable, and with -ENOSPC on a full

filesystem the next read-write mount fails.

Start transactions with btrfs_start_transaction_fallback_global_rsv() in

btrfs_orphan_cleanup(), drop_verity_items() and rollback_verity(). Those

calls only delete items and free the space in the end, so they may use

the global reserve and skip the qgroup limit, which avoids -ENOSPC and

-EDQUOT.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References