Bug 2448690 (CVE-2025-71269)

Summary: CVE-2025-71269 kernel: btrfs: do not free data reservation in fallback from inline due to -ENOSPC
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A resource accounting flaw was found in the Linux kernel's btrfs filesystem. When creating an inline extent fails with -ENOSPC, the code falls back to the normal COW (copy-on-write) path. However, it incorrectly frees the reserved qgroup data even though the data will still be written via the fallback path. This causes qgroup accounting to become inconsistent, potentially allowing data writes to exceed quota limits.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-03-18 18:02:34 UTC 
In the Linux kernel, the following vulnerability has been resolved:

btrfs: do not free data reservation in fallback from inline due to -ENOSPC

If we fail to create an inline extent due to -ENOSPC, we will attempt to
go through the normal COW path, reserve an extent, create an ordered
extent, etc. However we were always freeing the reserved qgroup data,
which is wrong since we will use data. Fix this by freeing the reserved
qgroup data in __cow_file_range_inline() only if we are not doing the
fallback (ret is <= 0).
Comment 1 Jon Moroney 2026-03-18 19:49:01 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026031816-CVE-2025-71269-b47d@gregkh/T