---
id: CVE-2025-71269
title: 'btrfs: do not free data reservation in fallback from inline due to -ENOSPC'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: do not free data reservation in fallback from inline due to -ENOSPC

  If we fail to create an inline extent due to -ENOSPC, we will attempt to
  go through the norm…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 94ed938aba557aa798acf496f09afb289b619fcd <
    3edd1f6c7c520536b62b2904807033597554dbac
  - >-
    Linux >= 94ed938aba557aa798acf496f09afb289b619fcd <
    3a9fd45afadec1fbfec72057b9473d509fa8b68c
  - >-
    Linux >= 94ed938aba557aa798acf496f09afb289b619fcd <
    0a1fbbd780f04d1b6cf48dd327c866ba937de1c4
  - >-
    Linux >= 94ed938aba557aa798acf496f09afb289b619fcd <
    6de3a371a8b9fd095198b1aa68c22cc10a4c6961
  - >-
    Linux >= 94ed938aba557aa798acf496f09afb289b619fcd <
    f8da41de0bff9eb1d774a7253da0c9f637c4470a
  - Linux 4.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:06:14.308547Z'
published: '2026-03-18'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:48.331Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71269'
references:
  - url: 'https://git.kernel.org/stable/c/3edd1f6c7c520536b62b2904807033597554dbac'
  - url: 'https://git.kernel.org/stable/c/3a9fd45afadec1fbfec72057b9473d509fa8b68c'
  - url: 'https://git.kernel.org/stable/c/0a1fbbd780f04d1b6cf48dd327c866ba937de1c4'
  - url: 'https://git.kernel.org/stable/c/6de3a371a8b9fd095198b1aa68c22cc10a4c6961'
  - url: 'https://git.kernel.org/stable/c/f8da41de0bff9eb1d774a7253da0c9f637c4470a'
tags:
  - cve.org
epss: 0.00228
epssPercentile: 0.12633
ingestedAt: '2026-10-16T17:24:46.638Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: do not free data reservation in fallback from inline due to -ENOSPC

If we fail to create an inline extent due to -ENOSPC, we will attempt to
go through the normal COW path, reserve an extent, create an ordered
extent, etc. However we were always freeing the reserved qgroup data,
which is wrong since we will use data. Fix this by freeing the reserved
qgroup data in __cow_file_range_inline() only if we are not doing the
fallback (ret is <= 0).

## Affected

- `Linux >= 94ed938aba557aa798acf496f09afb289b619fcd < 3edd1f6c7c520536b62b2904807033597554dbac`
- `Linux >= 94ed938aba557aa798acf496f09afb289b619fcd < 3a9fd45afadec1fbfec72057b9473d509fa8b68c`
- `Linux >= 94ed938aba557aa798acf496f09afb289b619fcd < 0a1fbbd780f04d1b6cf48dd327c866ba937de1c4`
- `Linux >= 94ed938aba557aa798acf496f09afb289b619fcd < 6de3a371a8b9fd095198b1aa68c22cc10a4c6961`
- `Linux >= 94ed938aba557aa798acf496f09afb289b619fcd < f8da41de0bff9eb1d774a7253da0c9f637c4470a`
- `Linux 4.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.