btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.21 % · percentile 12 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() If we have an unexpected reloc_root for our root, we jump to the out label but never drop the reference we obtained for root, resulting in a leak. Add a missing btrfs_put_root() call.
References
- https://git.kernel.org/stable/c/f89df93e8aefa4c1c813f835559f2ac727f79766
- https://git.kernel.org/stable/c/3f586b4c92e4272fcd01bf0db0590b63acf3e85b
- https://git.kernel.org/stable/c/b3d39b03799600c76c33486e2d29b73a771023db
- https://git.kernel.org/stable/c/72f673d1c1deb819554d3e7e154f6d84301eb735
- https://git.kernel.org/stable/c/60a23d4ea169e27403f3bb023bb98036797c0206
- https://git.kernel.org/stable/c/7591d1727067d6063247901ad25c4bdc4e5695c4
- https://git.kernel.org/stable/c/ce6050bafb4e33377dc17fcc357736bfc351180c
European references
- ENISA EUVD · EUVD-2026-55608
- GCVE · GCVE-0-2026-68422
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1255 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1202 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1164 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1069 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 24213fa46c7080c31d79aa2e3e2f0d9480cab700 < f89df93e8aefa4c1c813f835559f2ac727f79766 ; affected 24213fa46c7080c31d79aa2e3e2f0d9480cab700 < 3f586b4c92e4272fcd01bf0db0590b63acf3e85b ; affected 24213fa46c7080c31d79aa2e3e2f0d9480cab700 < b3d39b03799600c76c33486e2d29b73a771023db ; affected 24213fa46c7080c31d79aa2e3e2f0d9480cab700 < 72f673d1c1deb819554d3e7e154f6d84301eb735 ; affected 24213fa46c7080c31d79aa2e3e2f0d9480cab700 < 60a23d4ea169e27403f3bb023bb98036797c0206 ; affected 24213fa46c7080c31d79aa2e3e2f0d9480cab700 < 7591d1727067d6063247901ad25c4bdc4e5695c4 |
| Linux · Linux | affected 5.13 ; unaffected 0 < 5.13 ; unaffected 5.15.216 ≤ 5.15.* ; unaffected 6.1.183 ≤ 6.1.* ; unaffected 6.6.148 ≤ 6.6.* ; unaffected 6.12.101 ≤ 6.12.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |