CVE-2026-90259 PUBLISHED

btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()

Assigner: Linux
Reserved: 11.09.2026 Published: 17.09.2026 Updated: 17.09.2026

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()

In that function, we round down the start position and round up the ending position.

But during the calculation of @len, we use "round_up(start + len, sectorsize)", which is the rounded up end position, not the rounded up length.

Which results a much larger length, and later we are still using "start + len", which is completely incorrect.

Fix it by declaring a local @aligned_start and @aligned_len and use them instead.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from bc42bda22345efdb5d8b578d1b4df2c6eaa85c58 to e6edde29990af8064b9d12217ec03db231ccd55d (excl.)
  • affected from bc42bda22345efdb5d8b578d1b4df2c6eaa85c58 to c4c136555ff90f1e2921cc42da43daac0ef9985e (excl.)
  • affected from bc42bda22345efdb5d8b578d1b4df2c6eaa85c58 to 9102b179512e11644fb0489ae62010a09afa199c (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 4.13 is affected
  • unaffected from 0 to 4.13 (excl.)
  • unaffected from 6.18.52 to 6.18.* (incl.)
  • unaffected from 7.2.6 to 7.2.* (incl.)
  • unaffected from 7.3-rc1 to * (incl.)

References