CVE-2026-68450btrfs: free mapping node on duplicate reloc root insert
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: btrfs: free mapping node on duplicate reloc root insert __add_reloc_root() allocates a mapping_node before inserting it into rc->reloc_root_tree. If rb_simple_insert() finds an existing entry, it returns the existing rb_node and leaves the newly allocated node unlinked. The error path then returns -EEXIST without freeing the new node. Since the node was never inserted into reloc_root_tree, the later cleanup in put_reloc_control() cannot find it either. Free the newly allocated node before returning -EEXIST. The callers currently assert that -EEXIST should not happen, so this is a defensive cleanup for an unexpected duplicate insert path. If the path is ever reached, the local allocation should still be released.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 57a304cfd43b2b4a5b44b8f5dc026abb34183068 builds before 29d9746812d8b7c37d594f484e994fd552c3ec33; from 57a304cfd43b2b4a5b44b8f5dc026abb34183068 before b7c5b8e1d5f0779dfbabc3068b7ac0f12e53b3a8; from 57a304cfd43b2b4a5b44b8f5dc026abb34183068 before 92bedc0455552b42ada1a1f42b0e3a8593cdfccc; 57a304cfd43b2b4a5b44b8f5dc026abb34183068 builds before 14a8be9428435ee17f17fae7991215c246b7fd43; from 57a304cfd43b2b4a5b44b8f5dc026abb34183068 before 797dc567146c7e3c4f8d9680e4fbc76e0a6d9151; from 57a304cfd43b2b4a5b44b8f5dc026abb34183068 before ae0629ff9ccb836416ada129f4edc7efea6eaaad; 57a304cfd43b2b4a5b44b8f5dc026abb34183068 builds before 6a8269b6459ed870a8156c106a0f597383907872 | CNA record |
References
- https://git.kernel.org/stable/c/29d9746812d8b7c37d594f484e994fd552c3ec33
- https://git.kernel.org/stable/c/b7c5b8e1d5f0779dfbabc3068b7ac0f12e53b3a8
- https://git.kernel.org/stable/c/92bedc0455552b42ada1a1f42b0e3a8593cdfccc
- https://git.kernel.org/stable/c/14a8be9428435ee17f17fae7991215c246b7fd43
- https://git.kernel.org/stable/c/797dc567146c7e3c4f8d9680e4fbc76e0a6d9151
- https://git.kernel.org/stable/c/ae0629ff9ccb836416ada129f4edc7efea6eaaad
- https://git.kernel.org/stable/c/6a8269b6459ed870a8156c106a0f597383907872
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.