CVE-2026-89645btrfs: drop recovered reloc root refs on recovery failure
- —Not scoredno CVSS score yet
- 0.25%Exploitation in 30 daysEPSS · top 84% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails, btrfs_recover_relocation() jumps to out_unset before merge_reloc_roots() and clean_dirty_subvols(). put_reloc_control() drops the list-owned relocation root references, but it does not clear fs_root->reloc_root or drop the references owned by those pointers. Mount cleanup only drops them when BTRFS_FS_ERROR is set, so an error such as -ENOMEM while processing a later root can leave references behind. Keep temporary references to the fs roots associated during recovery. On failure, clear their reloc_root pointers and drop the corresponding references. Once the first transaction commit succeeds, drop only the temporary fs root references and let the normal merge and cleanup paths handle the relocation roots. Fault injection on a pending-relocation image confirmed the cleanup gap. With an injected first-commit failure, 25 fs roots had reloc_root set with fs_error=0. With this fix, the same failure path drops that count to 0 before mount fails.
Timeline
ID reserved
By Linux
Published
- 49 days later
· 49 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.25% · top 84% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected f44deb7442edf42abee6be25fca7e3e86061b4c9 – < f671ffc678e0247aad77126670cb28c766d6ab3d
- affected f44deb7442edf42abee6be25fca7e3e86061b4c9 – < 7b8c6af17287899a5d00c70566831feac237d192
- affected f44deb7442edf42abee6be25fca7e3e86061b4c9 – < 2256d6dc5b88841a8a8b4fd9a9f04730705fb6fd
- affected f44deb7442edf42abee6be25fca7e3e86061b4c9 – < 8a64baeb5bbb706b83d2235c1e39f5b77183817f
- affected f44deb7442edf42abee6be25fca7e3e86061b4c9 – < 4d43107e807bcd92621106b07f5011411c6341a8
- affected f44deb7442edf42abee6be25fca7e3e86061b4c9 – < 6d8ba4572922e336f0b59a80751b018e1e135164
- affected 5.7
- unaffected < 5.7
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.109 – ≤ 6.12.*
- unaffected 6.18.50 – ≤ 6.18.*
- unaffected 7.2.4 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/f671ffc678e0247aad77126670cb28c766d6ab3d (opens in a new tab)
- https://git.kernel.org/stable/c/7b8c6af17287899a5d00c70566831feac237d192 (opens in a new tab)
- https://git.kernel.org/stable/c/2256d6dc5b88841a8a8b4fd9a9f04730705fb6fd (opens in a new tab)
- https://git.kernel.org/stable/c/8a64baeb5bbb706b83d2235c1e39f5b77183817f (opens in a new tab)
- https://git.kernel.org/stable/c/4d43107e807bcd92621106b07f5011411c6341a8 (opens in a new tab)
- https://git.kernel.org/stable/c/6d8ba4572922e336f0b59a80751b018e1e135164 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-76557 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89645)Record last updated .