CVE-2026-68450

Received Received - Intake

Btrfs Filesystem Duplicate Reloc Root Insertion Memory Leak

Publication date: 2026-08-12

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: free mapping node on duplicate reloc root insert __add_reloc_root() allocates a mapping_node before inserting it into rc->reloc_root_tree. If rb_simple_insert() finds an existing entry, it returns the existing rb_node and leaves the newly allocated node unlinked. The error path then returns -EEXIST without freeing the new node. Since the node was never inserted into reloc_root_tree, the later cleanup in put_reloc_control() cannot find it either. Free the newly allocated node before returning -EEXIST. The callers currently assert that -EEXIST should not happen, so this is a defensive cleanup for an unexpected duplicate insert path. If the path is ever reached, the local allocation should still be released.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-19

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-68450

EUVD

EUVD-2026-57056

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory leak vulnerability in the Linux kernel's Btrfs filesystem. When inserting a duplicate relocation root, the system allocates memory for a mapping node but fails to free it if the insertion fails. This leaves unused memory allocated, which could accumulate over time and cause system resource exhaustion.

Detection Guidance

This vulnerability is specific to the Linux kernel's btrfs filesystem and requires kernel-level inspection. Detection involves checking kernel logs for btrfs-related errors or crashes. Use commands like dmesg | grep btrfs or journalctl -k | grep btrfs to search for errors. If the system is affected, errors related to duplicate reloc root insertions may appear.

Impact Analysis

The impact is primarily on system stability and resource usage. Over time, repeated exploitation could lead to memory exhaustion, causing system slowdowns, crashes, or denial of service. It does not directly expose data but may indirectly affect system availability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory leak in the Linux kernel's btrfs filesystem related to reloc root insertion, which could lead to resource exhaustion but does not involve data breaches or unauthorized access.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the btrfs vulnerability. Reboot the system after updating. If immediate patching is not possible, avoid using btrfs features temporarily or restrict access to untrusted users to reduce exposure.

Hi! I’m here to help you understand CVE-2026-68450. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70