CVE-2026-89645 (GCVE-0-2026-89645)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-21 12:48
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails, btrfs_recover_relocation() jumps to out_unset before merge_reloc_roots() and clean_dirty_subvols(). put_reloc_control() drops the list-owned relocation root references, but it does not clear fs_root->reloc_root or drop the references owned by those pointers. Mount cleanup only drops them when BTRFS_FS_ERROR is set, so an error such as -ENOMEM while processing a later root can leave references behind. Keep temporary references to the fs roots associated during recovery. On failure, clear their reloc_root pointers and drop the corresponding references. Once the first transaction commit succeeds, drop only the temporary fs root references and let the normal merge and cleanup paths handle the relocation roots. Fault injection on a pending-relocation image confirmed the cleanup gap. With an injected first-commit failure, 25 fs roots had reloc_root set with fs_error=0. With this fix, the same failure path drops that count to 0 before mount fails.
References
Impacted products
Vendor Product Version
Linux Linux Version: f44deb7442edf42abee6be25fca7e3e86061b4c9
Version: f44deb7442edf42abee6be25fca7e3e86061b4c9
Version: f44deb7442edf42abee6be25fca7e3e86061b4c9
Version: f44deb7442edf42abee6be25fca7e3e86061b4c9
Version: f44deb7442edf42abee6be25fca7e3e86061b4c9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/relocation.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b8c6af17287899a5d00c70566831feac237d192",
              "status": "affected",
              "version": "f44deb7442edf42abee6be25fca7e3e86061b4c9",
              "versionType": "git"
            },
            {
              "lessThan": "2256d6dc5b88841a8a8b4fd9a9f04730705fb6fd",
              "status": "affected",
              "version": "f44deb7442edf42abee6be25fca7e3e86061b4c9",
              "versionType": "git"
            },
            {
              "lessThan": "8a64baeb5bbb706b83d2235c1e39f5b77183817f",
              "status": "affected",
              "version": "f44deb7442edf42abee6be25fca7e3e86061b4c9",
              "versionType": "git"
            },
            {
              "lessThan": "4d43107e807bcd92621106b07f5011411c6341a8",
              "status": "affected",
              "version": "f44deb7442edf42abee6be25fca7e3e86061b4c9",
              "versionType": "git"
            },
            {
              "lessThan": "6d8ba4572922e336f0b59a80751b018e1e135164",
              "status": "affected",
              "version": "f44deb7442edf42abee6be25fca7e3e86061b4c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/relocation.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: drop recovered reloc root refs on recovery failure\n\nDuring relocation recovery, each fs root gets a reference to its relocation\nroot. If loading or adding a later root fails, or if the first transaction\ncommit fails, btrfs_recover_relocation() jumps to out_unset before\nmerge_reloc_roots() and clean_dirty_subvols().\n\nput_reloc_control() drops the list-owned relocation root references, but it\ndoes not clear fs_root-\u003ereloc_root or drop the references owned by those\npointers. Mount cleanup only drops them when BTRFS_FS_ERROR is set, so an\nerror such as -ENOMEM while processing a later root can leave references\nbehind.\n\nKeep temporary references to the fs roots associated during recovery. On\nfailure, clear their reloc_root pointers and drop the corresponding\nreferences. Once the first transaction commit succeeds, drop only the\ntemporary fs root references and let the normal merge and cleanup paths\nhandle the relocation roots.\n\nFault injection on a pending-relocation image confirmed the cleanup gap.\nWith an injected first-commit failure, 25 fs roots had reloc_root set with\nfs_error=0. With this fix, the same failure path drops that count to 0\nbefore mount fails."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:48:10.042Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b8c6af17287899a5d00c70566831feac237d192"
        },
        {
          "url": "https://git.kernel.org/stable/c/2256d6dc5b88841a8a8b4fd9a9f04730705fb6fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a64baeb5bbb706b83d2235c1e39f5b77183817f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d43107e807bcd92621106b07f5011411c6341a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d8ba4572922e336f0b59a80751b018e1e135164"
        }
      ],
      "title": "btrfs: drop recovered reloc root refs on recovery failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89645",
    "datePublished": "2026-09-11T19:45:37.016Z",
    "dateReserved": "2026-09-11T19:38:34.741Z",
    "dateUpdated": "2026-10-21T12:48:10.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.