Executive brief
The Linux kernel's btrfs filesystem has a memory management flaw in its file relocation logic that can cause a crash or data corruption when relocation operations encounter errors. When a relocation process fails during certain operations, freed memory is not properly cleared, leading to the system attempting to use or free the same memory twice, which can cause a system crash during filesystem unmount.
Technical details
A use-after-free vulnerability exists in the btrfs relocation code where btrfs_update_reloc_root() failure in insert_dirty_subvol() leaves a root's reloc_root field pointing to freed memory instead of NULL. During error handling and cleanup, free_reloc_roots() frees the reloc root, but clean_dirty_subvols() fails to clear the dangling pointer because the affected root was not added to the dirty_subvol_roots list. This results in btrfs_put_root() attempting to access or free already-freed memory during unmount, triggering a use-after-free or double-free condition detected by KASAN.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-09-24: disclosed