Executive brief
A memory leak exists in the Linux kernel's Btrfs filesystem relocation code. When a duplicate relocation root is detected, an allocated memory node fails to be freed before returning an error, causing a small amount of kernel memory to leak with each occurrence. While this is a defensive fix for an edge case that should not happen under normal circumstances, the leaked memory could accumulate if the condition is repeatedly triggered.
Technical details
The vulnerability is a resource leak in the __add_reloc_root() function in fs/btrfs/relocation.c. The function allocates a mapping_node and attempts to insert it into rc->reloc_root_tree via rb_simple_insert(). If a duplicate entry exists, rb_simple_insert() returns the existing node and leaves the newly allocated node unlinked. The error path then returns -EEXIST without freeing the unlinked allocation. Since the node was never inserted into the tree, the later cleanup routine put_reloc_control() cannot find and free it either. The fix adds a kfree(node) call before returning -EEXIST. No authentication or network access is required; this is triggered only in the kernel's internal relocation path during filesystem operations.
Affected products
- Linux Linux kernel multiple versions (the fix is present in linux-6.x and linux-7.x series and backported to various stable branches)
Timeline
- 2026-08-12: disclosed: CVE published on NVD
- 2026-07-12: patched: Upstream commit 6a8269b6459ed870a8156c106a0f597383907872 authored
- 2026-08-03: other: Patch backported to stable series linux-6.1.y
- 2026-08-19: other: Patch backported to stable series linux-5.15.y