CVE-2026-98279 btrfs: handle lack of space when cleaning up verity items
A local attacker can force the filesystem read-only or prevent mounting by triggering quota limits during verity cleanup, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98279?
CVE-2026-98279 is a denial of service vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: handle lack of space when cleaning up verity items
When enable_verity() hits the qgroup limit, rollback_verity() needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesystem is forced read-only even though the qgroup limit was for one subvolume only. Also orphan cleanup at the next mount fails the same way, so the leftover items are never removed: with -EDQUOT the subvolume stays unreachable, and with -ENOSPC on a full filesystem the next read-write mount fails.
Start transactions with btrfs_start_transaction_fallback_global_rsv() in btrfs_orphan_cleanup(), drop_verity_items() and rollback_verity(). Those calls only delete items and free the space in the end, so they may use the global reserve and skip the qgroup limit, which avoids -ENOSPC and -EDQUOT.
Which versions are affected by CVE-2026-98279?
How do I fix CVE-2026-98279?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98279 being exploited?
There is no known exploitation of CVE-2026-98279 in the wild and no public exploit code.
Sources
Also known as AZL-106242, BELL-CVE-2026-98279, DEBIAN-CVE-2026-98279, GHSA-ccw7-243p-5699, UBUNTU-CVE-2026-98279.