CVE-2023-54158: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54158 is a qgroup space leak vulnerability in the Linux kernel's Btrfs filesystem subsystem. The flaw occurs in the btrfs_insert_delayed_dir_index() function, where qgroup (quota group) reserved space is incorrectly freed when the kernel optimizes directory item packing into already-modified leaves. The issue was introduced as a side effect of a change that stopped performing a transaction commit during subvolume creation, making the leak more easily triggered — particularly when performing mkdir followed by subvolume creation with qgroups enabled. It was published to the CVE database on December 24, 2025, and affects the Linux kernel; a CVSS score has not been publicly assigned at this time (CVE Record, Feedly).

The root cause is an improper resource release (CWE-772) in the Btrfs delayed inode code path. When btrfs_insert_delayed_dir_index() determines it can pack a directory item into an already-modified leaf, it calls btrfs_block_rsv_release() to free extra reservations. However, trans->block_rsv at this point points to the temporary block reservation for the subvolume create operation, which contains qgroup reservations. The btrfs_block_rsv_release() function then incorrectly releases qgroup space (qgroup_rsv_reserved) that should not be freed at that stage, resulting in a qgroup accounting leak. The bug is reproducible by enabling qgroups and performing a mkdir followed by a subvolume create operation (CVE Record).

The primary impact of this vulnerability is incorrect qgroup (quota group) accounting within the Btrfs filesystem, leading to a resource leak. This can cause qgroup-enforced disk quotas to become inaccurate, potentially allowing users to consume more disk space than their quota permits or causing quota enforcement to behave unexpectedly. There is no known confidentiality or integrity impact beyond filesystem accounting correctness, and the vulnerability does not enable privilege escalation or remote code execution (CVE Record).

The fix has been committed to the Linux kernel stable tree across multiple branches, with patches available at the upstream kernel Git repository (commits 1e05bf5e80bb, 04ff6bd03177, 15e877e5923e, 148b16cd30b2, and 478bd15f46b6). Users should update to a patched kernel version that includes these fixes. As a workaround, disabling Btrfs qgroups (if not required) will prevent the leak from occurring. Linux distribution maintainers (e.g., Red Hat) are tracking this issue for inclusion in their respective kernel updates (CVE Record, Red Hat).