In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix qgroup reserve leaks in cow_file_range
In the buffered write path, the dirty page owns the qgroup reserve until it creates an ordered_extent.
Therefore, any errors that occur before the ordered_extent is created must free that reservation, or else the space is leaked. The fstest generic/475 exercises various IO error paths, and is able to trigger errors in cow_file_range where we fail to get to allocating the ordered extent. Note that because we *do* clear delalloc, we are likely to remove the inode from the delalloc list, so the inodes/pages to not have invalidate/launder called on them in the commit abort path.
This results in failures at the unmount stage of the test that look like:
BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs] Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W 6.10.0-rc7-gab56fde445b8 #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:close_ctree+0x222/0x4d0 [btrfs] RSP: 0018:ffffb4465283be00 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8 RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0 Call Trace: <TASK> ? close_ctree+0x222/0x4d0 [btrfs] ? __warn.cold+0x8e/0xea ? close_ctree+0x222/0x4d0 [btrfs] ? report_bug+0xff/0x140 ? handle_bug+0x3b/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? close_ctree+0x222/0x4d0 [btrfs] generic_shutdown_super+0x70/0x160 kill_anon_super+0x11/0x40 btrfs_kill_super+0x11/0x20 [btrfs] deactivate_locked_super+0x2e/0xa0 cleanup_mnt+0xb5/0x150 task_work_run+0x57/0x80 syscall_exit_to_user_mode+0x121/0x130 do_syscall_64+0xab/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f916847a887 ---[ end trace 0000000000000000 ]--- BTRFS error (device dm-8 state EA): qgroup reserved space leaked
Cases 2 and 3 in the out_reserve path both pertain to this type of leak and must free the reserved qgroup data. Because it is already an error path, I opted not to handle the possible errors in btrfs_free_qgroup_data.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade python3-perfUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-develUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-libbpf-debuginfoUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-6.1.140-154.222Upgrade kernel-libbpfUpgrade kernel-toolsUpgrade kernel-libbpf-develUpgrade kernel-modules-extra-commonUpgrade kernelUpgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headers | Aug 5, 2025 | Sep 18, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Apr 29, 2025 | Sep 18, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade bpftool | Dec 12, 2024 | Sep 18, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 18, 2024 |
| Suse | — | Upgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade dtb-mediatekUpgrade kernel-kvmsmall-develUpgrade kselftests-kmp-defaultUpgrade kernel-default-vdsoUpgrade kernel-rt-develUpgrade dtb-allwinnerUpgrade dtb-amazonUpgrade dtb-exynosUpgrade ocfs2-kmp-azureUpgrade kernel-64kb-develUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-obs-qaUpgrade dlm-kmp-azureUpgrade dtb-xilinxUpgrade kernel-develUpgrade kernel-docsUpgrade kernel-default-optionalUpgrade dtb-renesasUpgrade kernel-debug-develUpgrade kernel-devel-rtUpgrade kernel-64kbUpgrade cluster-md-kmp-defaultUpgrade gfs2-kmp-rtUpgrade dtb-armUpgrade dtb-hisiliconUpgrade dtb-apmUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-64kbUpgrade kernel-symsUpgrade kernel-default-extraUpgrade kernel-default-livepatch-develUpgrade kernel-debugUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade dtb-caviumUpgrade kernel-default-develUpgrade ocfs2-kmp-defaultUpgrade kernel-default-baseUpgrade gfs2-kmp-azureUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade dtb-amlogicUpgrade kernel-azureUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-sourceUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-develUpgrade kernel-azure-optionalUpgrade dtb-marvellUpgrade dtb-nvidiaUpgrade kernel-obs-buildUpgrade kernel-source-rtUpgrade dlm-kmp-defaultUpgrade dtb-appleUpgrade dlm-kmp-rtUpgrade kernel-azure-extraUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-macrosUpgrade kernel-rtUpgrade dtb-socionextUpgrade kernel-syms-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debugUpgrade dtb-lgUpgrade cluster-md-kmp-64kbUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade dtb-broadcomUpgrade kernel-source-azureUpgrade reiserfs-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-devel-azureUpgrade kernel-64kb-extraUpgrade kernel-rt-optionalUpgrade dtb-alteraUpgrade kselftests-kmp-azureUpgrade kernel-defaultUpgrade dtb-freescaleUpgrade kernel-default-livepatchUpgrade dtb-sprdUpgrade kselftests-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-rt-vdsoUpgrade kernel-syms-rt | Dec 5, 2025 | Sep 18, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1020-azureUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-kvmUpgrade linux-image-oem-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-oem-22.04cUpgrade linux-image-oracle-64kUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gcpUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-generic-lpaeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-oracleUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-gkeUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-azure-fdeUpgrade linux-image-oem-22.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-azureUpgrade linux-image-oem-22.04dUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-awsUpgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-6.8.0-1018-oemUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-genericUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-raspi | Dec 13, 2024 | Sep 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Sep 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub