CVE-2026-90259

A flaw was found in btrfs qgroup. An incorrect length calculation in the qgroup_free_reserved_data() function can lead to a much larger length being used than intended. This error in calculation may result in improper data handling, potentially causing system instability or data corruption.

A moderate severity flaw was found in the Linux kernel's btrfs qgroup (quota group) implementation. In qgroup_free_reserved_data(), the length to be freed is computed with "round_up(start + len, sectorsize)", which is the rounded-up end position rather than the rounded-up length, and this incorrectly large length is then used together with the original unaligned "start + len" range. As a result, a much larger length than intended can be used when freeing reserved data, leading to improper data handling that may cause data corruption or system instability on btrfs file systems with qgroups enabled. Triggering the flaw requires local access and low privileges to perform file operations that exercise qgroup reserved-data accounting on an affected btrfs file system. Red Hat rates this flaw as Moderate severity with availability impact only (CVSS 3.1: 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The vulnerable code is present in Red Hat Enterprise Linux 10 (kernel) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm components), where the fix is currently deferred; until a fixed update is delivered, the residual risk is that qgroup reserved-data accounting on btrfs file systems with qgroups enabled can free incorrect ranges, potentially corrupting data or destabilizing the system. Red Hat Enterprise Linux 6, 7, 8, and 9 (kernel and kernel-rt) and the OpenShift Container Platform RHCOS images are not affected because the vulnerable code is not present in those shipping kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable code path is exercised only when btrfs qgroup accounting is in use. On systems where qgroup functionality is not required, disabling it avoids the vulnerable code path: run "btrfs quota disable <mount-point>" as root on each affected btrfs file system and avoid re-enabling qgroups or applying qgroup limits, as this removes qgroup reserved-data accounting at the cost of losing quota tracking. For environments that require qgroup accounting, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.