In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix qgroup reserve leaks in cow_file_range
In the buffered write path, the dirty page owns the qgroup reserve until it creates an ordered_extent.
Therefore, any errors that occur before the ordered_extent is created must free that reservation, or else the space is leaked. The fstest generic/475 exercises various IO error paths, and is able to trigger errors in cow_file_range where we fail to get to allocating the ordered extent. Note that because we *do* clear delalloc, we are likely to remove the inode from the delalloc list, so the inodes/pages to not have invalidate/launder called on them in the commit abort path.
This results in failures at the unmount stage of the test that look like:
BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs] Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W 6.10.0-rc7-gab56fde445b8 #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:close_ctree+0x222/0x4d0 [btrfs] RSP: 0018:ffffb4465283be00 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8 RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0 Call Trace: <TASK> ? close_ctree+0x222/0x4d0 [btrfs] ? __warn.cold+0x8e/0xea ? close_ctree+0x222/0x4d0 [btrfs] ? report_bug+0xff/0x140 ? handle_bug+0x3b/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? close_ctree+0x222/0x4d0 [btrfs] generic_shutdown_super+0x70/0x160 kill_anon_super+0x11/0x40 btrfs_kill_super+0x11/0x20 [btrfs] deactivate_locked_super+0x2e/0xa0 cleanup_mnt+0xb5/0x150 task_work_run+0x57/0x80 syscall_exit_to_user_mode+0x121/0x130 do_syscall_64+0xab/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f916847a887 ---[ end trace 0000000000000000 ]--- BTRFS error (device dm-8 state EA): qgroup reserved space leaked
Cases 2 and 3 in the out_reserve path both pertain to this type of leak and must free the reserved qgroup data. Because it is already an error path, I opted not to handle the possible errors in btrfs_free_qgroup_data.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade python3-perf-debuginfoUpgrade kernel-develUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade kernel-livepatch-6.1.140-154.222Upgrade kernel-libbpf-staticUpgrade kernel-libbpf-debuginfoUpgrade python3-perfUpgrade kernel-tools-develUpgrade kernel-modules-extraUpgrade bpftoolUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade kernel-modules-extra-commonUpgrade kernel-headersUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade perf-debuginfo | Aug 5, 2025 | Sep 18, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Apr 29, 2025 | Sep 18, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools | Dec 12, 2024 | Sep 18, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 18, 2024 |
| Suse | — | Upgrade reiserfs-kmp-azureUpgrade dtb-apmUpgrade ocfs2-kmp-azureUpgrade dtb-caviumUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-64kb-develUpgrade kernel-symsUpgrade gfs2-kmp-64kbUpgrade kernel-default-baseUpgrade kernel-default-develUpgrade kernel-devel-rtUpgrade kernel-default-extraUpgrade kernel-default-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-debug-develUpgrade dtb-allwinnerUpgrade dtb-exynosUpgrade dtb-xilinxUpgrade dtb-amazonUpgrade dtb-renesasUpgrade kernel-docsUpgrade kernel-obs-qaUpgrade dlm-kmp-azureUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-default-optionalUpgrade dtb-mediatekUpgrade kernel-develUpgrade dtb-amdUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-rtUpgrade kernel-64kbUpgrade kernel-rt-develUpgrade cluster-md-kmp-defaultUpgrade dtb-hisiliconUpgrade dtb-armUpgrade kselftests-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade dtb-lgUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade dtb-broadcomUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-rt-livepatch-develUpgrade dtb-qcomUpgrade kernel-rtUpgrade dtb-alteraUpgrade kselftests-kmp-azureUpgrade kernel-default-livepatchUpgrade kernel-defaultUpgrade dtb-freescaleUpgrade kernel-64kb-extraUpgrade dtb-socionextUpgrade kernel-syms-azureUpgrade kernel-source-azureUpgrade kernel-rt-optionalUpgrade kernel-rt-extraUpgrade kernel-devel-azureUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-syms-rtUpgrade dtb-sprdUpgrade kselftests-kmp-64kbUpgrade kernel-rt-vdsoUpgrade dlm-kmp-64kbUpgrade dtb-amlogicUpgrade dtb-appleUpgrade kernel-source-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-develUpgrade kernel-macrosUpgrade kernel-azure-extraUpgrade dlm-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-sourceUpgrade dtb-marvellUpgrade kernel-obs-buildUpgrade dtb-nvidiaUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-optionalUpgrade kernel-azure-vdsoUpgrade kernel-azureUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade dtb-rockchip | Dec 5, 2025 | Sep 18, 2025 |
| Ubuntu | — | Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-genericUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-6.8.0-1018-oemUpgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidiaUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-lowlatencyUpgrade linux-image-oem-22.04aUpgrade linux-image-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-kvmUpgrade linux-image-oem-24.04aUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-oem-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1020-awsUpgrade linux-image-gkeUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-nvidia-64k | Dec 13, 2024 | Sep 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Sep 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub