CVE-2026-90259EPSS p9.7%
CVE-2026-90259CVE-2026-90259
Description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
In that function, we round down the start position and round up the
ending position.
But during the calculation of @len, we use "round_up(start + len,
sectorsize)", which is the rounded up end position, not the rounded up
length.
Which results a much larger length, and later we are still using
"start + len", which is completely incorrect.
Fix it by declaring a local @aligned_start and @aligned_len and use them
instead.
Scoring
| EPSS | 0.21% probability of exploitation · percentile 9.7% · 2026-10-05T12:00:23Z |
| Last modified | 2026-09-17 |