CVE-2026-93798 (GCVE-0-2026-93798)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:02 – Updated: 2026-09-25 12:43
VLAI
Title
btrfs: fix reloc root cleanup in merge_reloc_roots()
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reloc root cleanup in merge_reloc_roots() If the root we got has zero root refs in its root item, we are resetting the root's ->reloc_root without using barriers like we do everywhere else. Sashiko complained about this while reviewing another patch, and it's correct (see the Link tag below). Also, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless the root points to the reloc root we have. Fix this by using clear_reloc_root(), which issues the memory barrier after setting the root's ->reloc_root to NULL and before clearing the bit BTRFS_ROOT_DEAD_RELOC_TREE from the root.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1dae7e0e58b484eaa43d530f211098fdeeb0f404 , < ab48583aa9948205ff9a6470e23dbff74c565e24 (git)
Affected: 1dae7e0e58b484eaa43d530f211098fdeeb0f404 , < 63d6b1f04cd91c825329712aa526215ffa5d11ca (git)
Affected: 1dae7e0e58b484eaa43d530f211098fdeeb0f404 , < b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8 (git)
Affected: ee08663380ffd5a45a1c87580fbc305e8413c235 (git)
Affected: 33823378ff2b510fd7b566f25bb18438aeb9b23b (git)
Affected: 5.4.54 , < 5.5 (semver)
Affected: 5.7.11 , < 5.8 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/relocation.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ab48583aa9948205ff9a6470e23dbff74c565e24",
              "status": "affected",
              "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
              "versionType": "git"
            },
            {
              "lessThan": "63d6b1f04cd91c825329712aa526215ffa5d11ca",
              "status": "affected",
              "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
              "versionType": "git"
            },
            {
              "lessThan": "b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8",
              "status": "affected",
              "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee08663380ffd5a45a1c87580fbc305e8413c235",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33823378ff2b510fd7b566f25bb18438aeb9b23b",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.54",
              "versionType": "semver"
            },
            {
              "lessThan": "5.8",
              "status": "affected",
              "version": "5.7.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/relocation.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.7.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix reloc root cleanup in merge_reloc_roots()\n\nIf the root we got has zero root refs in its root item, we are resetting\nthe root\u0027s -\u003ereloc_root without using barriers like we do everywhere else.\nSashiko complained about this while reviewing another patch, and it\u0027s\ncorrect (see the Link tag below).\n\nAlso, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless\nthe root points to the reloc root we have.\n\nFix this by using clear_reloc_root(), which issues the memory barrier\nafter setting the root\u0027s -\u003ereloc_root to NULL and before clearing the bit\nBTRFS_ROOT_DEAD_RELOC_TREE from the root."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - merge_reloc_roots() is reached from local VFS activity: unlink/write call btrfs_update_block_group() which btrfs_mark_bg_to_reclaim(); btrfs_reclaim_bgs_work() then runs btrfs_relocate_chunk()-\u003ebtrfs_relocate_block_group()-\u003erelocate_block_group()-\u003eprepare_to_merge()-\u003emerge_reloc_roots(). No network protocol supplies the causing state.\nAC:L - When relocate_block_group() fails (the attacker can force ENOSPC via extra allocations), prepare_to_merge() leaves reloc roots at 0 refs and merge_reloc_roots() NULLs root-\u003ereloc_root then clear_bit(BTRFS_ROOT_DEAD_RELOC_TREE) without smp_wmb(). Concurrent writes invoke btrfs_init_reloc_root()/have_reloc_root() on that same root, so the attacker drives both sides.\nPR:L - BTRFS_IOC_BALANCE requires capable(CAP_SYS_ADMIN), but btrfs_buffered_write() and unlink used to mark a block group reclaimable have no capability gate. btrfs_fs_type lacks FS_USERNS_MOUNT, so the volume is admin-mounted, yet any unprivileged uid with write permission on that mount can induce reclaim into merge_reloc_roots().\nUI:N - The attacker induces the 0-ref merge_reloc_roots() cleanup with their own writes and deletions on a btrfs they can already write, then races have_reloc_root() with further writes or btrfs_ioctl_snap_create(); no second user needs to mount an image or run balance.\nS:U - The use-after-free is of the struct btrfs_root stored in fs_root-\u003ereloc_root inside the same host kernel that mounted the volume; merge_reloc_roots() does not cross a VM, IOMMU, or sandbox authority.\nC:H - Missing smp_wmb() in merge_reloc_roots() lets have_reloc_root() see BTRFS_ROOT_DEAD_RELOC_TREE already clear while still loading the old root-\u003ereloc_root pointer; btrfs_should_ignore_reloc_root() then reads reloc_root-\u003ecommit_root after the matching btrfs_put_root() dropped that reloc root.\nI:H - The same stale reloc_root is written by btrfs_init_reloc_root() via btrfs_set_root_last_trans() and by commit_fs_roots()-\u003ebtrfs_update_reloc_root() which mutates reloc_root-\u003eroot_item, giving a write-after-free of struct btrfs_root.\nA:H - Using the dangling reloc_root after merge_reloc_roots()\u0027s btrfs_put_root() oopses; if clear_bit(BTRFS_ROOT_DEAD_RELOC_TREE) becomes visible while the pointer still refers to the 0-ref tree, btrfs_reloc_pre_snapshot() hits BUG_ON(btrfs_root_refs(\u0026root-\u003eroot_item)==0)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T12:43:04.957Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ab48583aa9948205ff9a6470e23dbff74c565e24"
        },
        {
          "url": "https://git.kernel.org/stable/c/63d6b1f04cd91c825329712aa526215ffa5d11ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8"
        }
      ],
      "title": "btrfs: fix reloc root cleanup in merge_reloc_roots()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93798",
    "datePublished": "2026-09-24T16:02:31.291Z",
    "dateReserved": "2026-09-18T17:59:28.789Z",
    "dateUpdated": "2026-09-25T12:43:04.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93798",
      "date": "2026-09-27",
      "epss": "0.00127",
      "percentile": "0.02023"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-28T02:04:09.000Z",
      "cve": "CVE-2026-93798",
      "id": "msrc_CVE-2026-93798",
      "initial_release_date": "2026-09-28T02:04:09.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: fix reloc root cleanup in merge_reloc_roots()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-93798.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/relocation.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ab48583aa9948205ff9a6470e23dbff74c565e24",
                    "status": "affected",
                    "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63d6b1f04cd91c825329712aa526215ffa5d11ca",
                    "status": "affected",
                    "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8",
                    "status": "affected",
                    "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "ee08663380ffd5a45a1c87580fbc305e8413c235",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "33823378ff2b510fd7b566f25bb18438aeb9b23b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.8",
                    "status": "affected",
                    "version": "5.7.11",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/relocation.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.8"
                  },
                  {
                    "lessThan": "5.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix reloc root cleanup in merge_reloc_roots()\n\nIf the root we got has zero root refs in its root item, we are resetting\nthe root\u0027s -\u003ereloc_root without using barriers like we do everywhere else.\nSashiko complained about this while reviewing another patch, and it\u0027s\ncorrect (see the Link tag below).\n\nAlso, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless\nthe root points to the reloc root we have.\n\nFix this by using clear_reloc_root(), which issues the memory barrier\nafter setting the root\u0027s -\u003ereloc_root to NULL and before clearing the bit\nBTRFS_ROOT_DEAD_RELOC_TREE from the root."
          }
        ],
        "id": "CVE-2026-93798",
        "lastModified": "2026-09-25T13:17:20.537",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T17:17:12.607",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/63d6b1f04cd91c825329712aa526215ffa5d11ca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ab48583aa9948205ff9a6470e23dbff74c565e24"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-28T12:25:22+00:00",
      "cve": "CVE-2026-93798",
      "id": "CVE-2026-93798",
      "initial_release_date": "2026-09-24T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "186",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix reloc root cleanup in merge_reloc_roots()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93798.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-25T23:48:51Z",
      "cve": "CVE-2026-93798",
      "id": "CVE-2026-93798",
      "initial_release_date": "2026-09-25T23:48:51Z",
      "product_status:known_affected": "204",
      "product_status:known_not_affected": "143",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-93798",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-93798.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.