CVE-2025-71269

Vulnerability

In the Linux kernel's btrfs filesystem, the function __cow_file_range_inline() incorrectly frees the reserved qgroup data reservation when creating an inline extent fails with -ENOSPC and the code falls back to the normal COW path. This results in a qgroup data reservation being freed even though it will be used by the fallback path, leading to incorrect resource accounting [1].

Exploitation

An attacker with local access to a btrfs filesystem could trigger this bug by causing an -ENOSPC error during inline extent creation, for example by filling the filesystem to near capacity and then performing a write operation that attempts to create an inline extent. No special privileges are required beyond normal file write permissions.

Impact

Incorrect qgroup data reservation accounting can lead to system instability, denial of service, or possible corruption of filesystem metadata under specific conditions. The vulnerability affects qgroup tracking used for quota enforcement and space accounting in btrfs.

Mitigation

The fix is included in Linux kernel stable updates starting from commits [1], [2], [3], and [4]. Users should update their kernel to a version containing the patch. No workaround is available other than applying the kernel update.