CVE-2026-98279

A moderate-severity denial-of-service flaw was found in the Linux kernel's Btrfs file system, affecting the kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. A local user with access to a file on a Btrfs subvolume can trigger the issue by enabling file verification (fsverity) when the subvolume's qgroup quota limit or available space is exhausted. Under these conditions, the rollback and subsequent orphan cleanup cannot acquire the metadata reservation needed to remove the leftover verity items, so the entire file system is forced into a read-only state even though the quota limit applied to only one subvolume; after -EDQUOT the subvolume can remain unreachable, and after -ENOSPC on a full file system the next read-write mount can fail. Confidentiality and integrity are not affected. Red Hat Enterprise Linux 7, 8, and 9, and the RHEL CoreOS-based OpenShift Container Platform releases, are not affected because the vulnerable code is not present in their shipped kernels, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope. A fix for the affected streams has been deferred to a future update; until it is applied, the residual risk is that a local user can repeatedly force the file system read-only and prevent subsequent read-write mounts.