CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-29 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the reference on the quota root, resulting in a leak of the root since fs_info->quota_root is no longer pointing to the root (we have set it to NULL just before those steps). Fix this by always doing a btrfs_put_root() call under the 'out' label. This is a problem that exists since qgroups were first added in 2012 by commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but back then we missed a kfree on the quota root and free_extent_buffer() calls on its root and commit root nodes, since back then roots were not yet reference counted.

Affected products

Linux kernel: before 5.10.223; from 5.11 before 5.15.164; from 5.16 before 6.1.101; from 6.2 before 6.6.42; from 6.7 before 6.9.11; 6.10-rc1, 6.10-rc2, 6.10-rc3, 6.10-rc4, 6.10-rc5 — fixed in 5.10.223, 5.15.164, 6.1.101, 6.6.42, 6.9.11

How to fix

Upgrade to a fixed version: Linux kernel 5.10.223, 5.15.164, 6.1.101, 6.6.42. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-41078 or the next vulnerability affects your stack