HIGH Introduced in 2.6.12
btrfs RelocRoot Race
CVE-2026-93798
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reloc root cleanup in merge_reloc_roots() If the root we got has zero root refs in its root item, we are resetting the root's ->reloc_root without using barriers like we do everywhere else. Sashiko complained about this while reviewing another patch, and it's correct (see the Link tag below). Also, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless the root points to the reloc root we have. Fix this by using clear_reloc_root(), which issues the memory barrier after setting the root's ->reloc_root to NULL and before clearing the bit BTRFS_ROOT_DEAD_RELOC_TREE from the root.
02KernelScan AI Analysis
Risk summary
A privileged local user who initiates btrfs balance or device-replace can trigger a race condition in relocation root cleanup, potentially causing kernel memory corruption. The bug requires root-level privileges and winning a narrow race window, limiting practical exploitability but still posing a risk of kernel crash or code execution on systems using btrfs.
Vulnerability analysis
During btrfs relocation cleanup, the code updates a pointer and clears a status flag without ensuring other processors see the changes in the correct order, and it clears the flag even for the wrong relocation root. This creates a race where another thread can see inconsistent state, potentially using a freed or stale relocation root and causing kernel memory corruption. The fix adds the required memory barrier between updating the pointer and clearing the flag, and ensures the flag is only cleared when the root actually matches the relocation root being removed. Only a privileged user with CAP_SYS_ADMIN who initiates btrfs balance or device-replace operations can reach this code path.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.4 | 5.4.54 | 5.5 | 29531470b1bf |
| 5.7 | 5.7.11 | 5.8 | 415f8665a969 |
| 5.10 | 2.6.12 | 5.10.271 | ee695a968aa7 |
| 5.15 | 2.6.12 | 5.15.222 | 0bc25f0a2d1b |
| 6.1 | 2.6.12 | 6.1.189 | ab48583aa994 |
| 6.6 | 2.6.12 | 6.6.158 | 63d6b1f04cd9 |
| 6.12 | 2.6.12 | 6.12.111 | b78fe9563e2d |
| 6.18 | 2.6.12 | 6.18.53 | — |
| mainline | 2.6.12 | 7.2 | — |
| cip/6.12 | 2.6.12 | 6.12.111-cip32 | ab48583aa994 |