CVE-2026-90259

Source
https://cve.org/CVERecord?id=CVE-2026-90259
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90259.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90259
Downstream
AZL (1)
BELL (1)
CLSA (3)
DEBIAN (1)
openSUSE (2)
SUSE (12)
UBUNTU (1)
Related
Published
2026-09-17T16:07:57Z
Modified
2026-11-01T02:30:19Z
Summary
btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
Details

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()

In that function, we round down the start position and round up the ending position.

But during the calculation of @len, we use "round_up(start + len, sectorsize)", which is the rounded up end position, not the rounded up length.

Which results a much larger length, and later we are still using "start + len", which is completely incorrect.

Fix it by declaring a local @aligned_start and @aligned_len and use them instead.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90259.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bc42bda22345efdb5d8b578d1b4df2c6eaa85c58
Fixed
036e6c216be66a085da3a0519f1be5f3230b6e26
Fixed
202ac9e469b78817512921c5db05cc2140e4ca43
Fixed
34adc843c28e5cd1f533a1d64f51b0f756fdf945
Fixed
e6edde29990af8064b9d12217ec03db231ccd55d
Fixed
c4c136555ff90f1e2921cc42da43daac0ef9985e
Fixed
9102b179512e11644fb0489ae62010a09afa199c

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90259.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.13.0
Fixed
6.1.191
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.114
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.52
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.6

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90259.json"