Executive brief
The btrfs filesystem driver's relocation recovery code fails to properly release memory references during certain error conditions, such as out-of-memory failures during mount. This can leave dangling reference counts on filesystem root objects, preventing full cleanup when a system recovers from an interrupted relocation operation. While the impact is primarily on system stability during recovery scenarios, it does not directly compromise user data or system security.
Technical details
This is a resource cleanup bug in the btrfs relocation recovery path (fs/btrfs/relocation.c). During recovery from an interrupted relocation, the code assigns references from relocation roots to filesystem roots. If an error occurs (such as -ENOMEM) before the first transaction commit completes, or during later root loading, the btrfs_recover_relocation() function exits via an error label without properly clearing the fs_root->reloc_root pointers and dropping their associated reference counts. The root cause is that put_reloc_control() only drops list-owned references, not the per-fs-root references. Mount cleanup only releases these references when BTRFS_FS_ERROR is set. The fix introduces a release_recovered_fs_roots() helper to explicitly clear reloc_root pointers and drop references on the error path, confirmed effective through fault injection testing that eliminated 25 leaked root references in the failure scenario.
Affected products
- Linux Linux kernel multiple versions (see upstream commit 6d8ba4572922e336f0b59a80751b018e1e135164)
Timeline
- 2026-09-11: disclosed: CVE published
- 2026-07-12: patched: Fix committed upstream (6d8ba4572922e336f0b59a80751b018e1e135164)
- 2026-09-07: other: Backported to stable kernel trees