CVE-2026-68422btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() If we have an unexpected reloc_root for our root, we jump to the out label but never drop the reference we obtained for root, resulting in a leak. Add a missing btrfs_put_root() call.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 24213fa46c7080c31d79aa2e3e2f0d9480cab700 before f89df93e8aefa4c1c813f835559f2ac727f79766; 24213fa46c7080c31d79aa2e3e2f0d9480cab700 builds before 3f586b4c92e4272fcd01bf0db0590b63acf3e85b; from 24213fa46c7080c31d79aa2e3e2f0d9480cab700 before b3d39b03799600c76c33486e2d29b73a771023db; 24213fa46c7080c31d79aa2e3e2f0d9480cab700 builds before 72f673d1c1deb819554d3e7e154f6d84301eb735; 24213fa46c7080c31d79aa2e3e2f0d9480cab700 builds before 60a23d4ea169e27403f3bb023bb98036797c0206; 24213fa46c7080c31d79aa2e3e2f0d9480cab700 builds before 7591d1727067d6063247901ad25c4bdc4e5695c4; from 24213fa46c7080c31d79aa2e3e2f0d9480cab700 before ce6050bafb4e33377dc17fcc357736bfc351180c | CNA record |
References
- https://git.kernel.org/stable/c/f89df93e8aefa4c1c813f835559f2ac727f79766
- https://git.kernel.org/stable/c/3f586b4c92e4272fcd01bf0db0590b63acf3e85b
- https://git.kernel.org/stable/c/b3d39b03799600c76c33486e2d29b73a771023db
- https://git.kernel.org/stable/c/72f673d1c1deb819554d3e7e154f6d84301eb735
- https://git.kernel.org/stable/c/60a23d4ea169e27403f3bb023bb98036797c0206
- https://git.kernel.org/stable/c/7591d1727067d6063247901ad25c4bdc4e5695c4
- https://git.kernel.org/stable/c/ce6050bafb4e33377dc17fcc357736bfc351180c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.