---
id: CVE-2025-71268
title: 'btrfs: fix reservation leak in some error paths when inserting inline extent'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: fix reservation leak in some error paths when inserting inline extent

  If we fail to allocate a path or join a transaction, we return from
  __cow_file_range_inlin…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 94ed938aba557aa798acf496f09afb289b619fcd <
    f7156512c8166d385f574b9ec030479aa7b1e8c9
  - >-
    Linux >= 94ed938aba557aa798acf496f09afb289b619fcd <
    28b97fcbbf523779688e8de5fe55bf2dae3859f6
  - >-
    Linux >= 94ed938aba557aa798acf496f09afb289b619fcd <
    f3ee1732851aec6fe6b2cec2ef1b32d4e71d9913
  - >-
    Linux >= 94ed938aba557aa798acf496f09afb289b619fcd <
    28768bd3abf9995a93f6e01bfce01c60622964dd
  - >-
    Linux >= 94ed938aba557aa798acf496f09afb289b619fcd <
    c1c050f92d8f6aac4e17f7f2230160794fceef0c
  - Linux 4.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:06:12.033724Z'
published: '2026-03-18'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:48.132Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71268'
references:
  - url: 'https://git.kernel.org/stable/c/f7156512c8166d385f574b9ec030479aa7b1e8c9'
  - url: 'https://git.kernel.org/stable/c/28b97fcbbf523779688e8de5fe55bf2dae3859f6'
  - url: 'https://git.kernel.org/stable/c/f3ee1732851aec6fe6b2cec2ef1b32d4e71d9913'
  - url: 'https://git.kernel.org/stable/c/28768bd3abf9995a93f6e01bfce01c60622964dd'
  - url: 'https://git.kernel.org/stable/c/c1c050f92d8f6aac4e17f7f2230160794fceef0c'
tags:
  - cve.org
epss: 0.00228
epssPercentile: 0.12632
ingestedAt: '2026-10-16T17:24:46.637Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix reservation leak in some error paths when inserting inline extent

If we fail to allocate a path or join a transaction, we return from
__cow_file_range_inline() without freeing the reserved qgroup data,
resulting in a leak. Fix this by ensuring we call btrfs_qgroup_free_data()
in such cases.

## Affected

- `Linux >= 94ed938aba557aa798acf496f09afb289b619fcd < f7156512c8166d385f574b9ec030479aa7b1e8c9`
- `Linux >= 94ed938aba557aa798acf496f09afb289b619fcd < 28b97fcbbf523779688e8de5fe55bf2dae3859f6`
- `Linux >= 94ed938aba557aa798acf496f09afb289b619fcd < f3ee1732851aec6fe6b2cec2ef1b32d4e71d9913`
- `Linux >= 94ed938aba557aa798acf496f09afb289b619fcd < 28768bd3abf9995a93f6e01bfce01c60622964dd`
- `Linux >= 94ed938aba557aa798acf496f09afb289b619fcd < c1c050f92d8f6aac4e17f7f2230160794fceef0c`
- `Linux 4.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.