Cloudanix VulnDB

CVE-2026-90259

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A math mistake in how a file system tracks reserved space could let local users cause crashes or memory problems on Linux computers.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect rounding in length calculation within btrfs qgroup_free_reserved_data leads to an overstated data length value being used in subsequent operations, causing improper memory or reservation handling.

Why it matters to the business

Organizations running Linux systems with btrfs may face unexpected kernel behavior, potential system instability, or corruption risks during quota group operations on large files or snapshots, increasing operational overhead for patching.

How an attack unfolds

An attacker with local access crafts specific file or snapshot operations that trigger the qgroup reserved data path, causing the miscalculated length to be applied and resulting in memory corruption or out-of-bounds access.

How to fix it

Update the Linux kernel to a version containing the fix for the length calculation in qgroup_free_reserved_data; apply the patch that introduces aligned_start and aligned_len variables.

How to confirm the fix worked

Confirm the kernel source contains the corrected qgroup_free_reserved_data function using aligned_start and aligned_len; test btrfs quota operations on affected workloads to verify no oversized length calculations occur.

Typical attack path

  1. Obtain local unprivileged access to a Linux system using btrfs.
  2. Create or manipulate files and snapshots to exercise quota group reservation paths.
  3. Trigger qgroup_free_reserved_data with parameters that expose the rounding error.
  4. Leverage resulting oversized length value to induce memory corruption or denial of service.

How to detect it

Review kernel logs for btrfs qgroup errors, oops messages, or memory allocation anomalies around quota operations; examine system call traces involving fallocate or snapshot creation for unexpected behavior.

What your security team should do

  • Prioritize kernel updates for all systems using btrfs filesystems.
  • Monitor for btrfs-related stability issues in production environments.
  • Review and restrict local user access where btrfs volumes host sensitive data.

The record

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "round_up(start + len, sectorsize)", which is the rounded up end position, not the rounded up length. Which results a much larger length, and later we are still using "start + len", which is completely incorrect. Fix it by declaring a local @aligned_start and @aligned_len and use them instead.

Affected packages

Ecosystem Package Introduced Fixed