CVE-2026-98279

In the Linux kernel, the following vulnerability has been resolved:

btrfs: handle lack of space when cleaning up verity items

When enable verity() hits the qgroup limit, rollback verity() needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesystem is forced read-only even though the qgroup limit was for one subvolume only. Also orphan cleanup at the next mount fails the same way, so the leftover items are never removed: with -EDQUOT the subvolume stays unreachable, and with -ENOSPC on a full filesystem the next read-write mount fails.

Start transactions with btrfs start transaction fallback global rsv() in btrfs orphan cleanup(), drop verity items() and rollback verity(). Those calls only delete items and free the space in the end, so they may use the global reserve and skip the qgroup limit, which avoids -ENOSPC and -EDQUOT.