PT-2026-104991 · Azure Linux · Kernel
Published
2026-09-24
·
Updated
2026-09-24
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix use-after-free on reloc root after error in insert dirty subvol()
If during relocation we fail in insert dirty subvol() because
btrfs update reloc root() returned an error, we will leave a root's
reloc root field pointing to a reloc root that was freed instead of NULL,
resulting later in a use-after-free, or double free attempt during
unmount.
The sequence of steps is this:
-
During relocation the call to btrfs update reloc root() in insert dirty subvol() fails, so insert dirty subvol() returns the error to merge reloc root() without adding the root to the list rc->dirty subvol roots;
-
Then merge reloc root() aborts the current transaction because insert dirty subvol() returned an error;
-
Up the call chain, merge reloc roots() gets the error, adds the reloc root for root X to the local reloc roots list and jumps to the 'out' label, where it calls free reloc roots() to free all the reloc roots in the local reloc roots list. This frees the reloc root for root X;
-
We go up the call chain to relocate block group() which calls clean dirty subvols() to go over dirty roots and set their ->reloc root field to NULL, but root X is not in the dirty subvol roots list, so its ->reloc root still points to a reloc root;
-
Relocation finishes, with an error and a transaction abort, but the ->reloc root field for root X still points to the reloc root that was freed in step 3;
-
When unmounting the fs we end up calling:btrfs free fs roots() btrfs drop and free fs root() --> calls btrfs put root() against root X's ->reloc root which is not NULL and points to the already freed reloc root in step 4 above
Resulting in a use-after-free to a double free attempt.
Syzbot reported this with the following dmesg/syslog:
[ 106.004389][ T5339] BTRFS error (device loop0 state A): Transaction aborted (error -5)
[ 106.014266][ T5339] BTRFS: error (device loop0 state A) in merge reloc root:1655: errno=-5 IO failure
[ 106.021891][ T1061] BTRFS error (device loop0 state A): error while writing out transaction: -5
[ 106.026964][ T1061] BTRFS warning (device loop0 state A): Skipping commit of aborted transaction.
[ 106.033807][ T5340] BTRFS error (device loop0 state A): bdev /dev/loop0 errs: wr 3, rd 0, flush 0, corrupt 0, gen 0
[ 106.039265][ T1061] BTRFS: error (device loop0 state A) in cleanup transaction:2067: errno=-5 IO failure
[ 106.044382][ T5339] BTRFS info (device loop0 state EA): forced readonly
[ 106.074329][ T5339] BTRFS: error (device loop0 state EA) in merge reloc roots:1887: errno=-5 IO failure
[ 106.081004][ T5356] BTRFS info (device loop0 state EA): scrub: started on devid 1
[ 106.085611][ T5339] BTRFS info (device loop0 state EA): balance: ended with status: -30
[ 106.089517][ T5356] BTRFS info (device loop0 state EA): scrub: not finished on devid 1 with status: -30
[ 106.662365][ T5338] BTRFS info (device loop0 state EA): last unmount of filesystem 3a375e4e-b156-4d76-a2ad-16e198ce1409
[ 106.682946][ T5338] ==================================================================
[ 106.686574][ T5338] BUG: KASAN: slab-use-after-free in btrfs put root+0x2f/0x250
[ 106.690090][ T5338] Write of size 4 at addr ffff88803f978630 by task syz.0.0/5338
[ 106.693173][ T5338]
[ 106.694279][ T5338] CPU: 0 UID: 0 PID: 5338 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 106.694293][ T5338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 106.694300][ T5338] Call Trace:
[ 106.694308][ T5338]
[ 106.694314][ T5338] dump stack lvl+0xe8/0x150
[ 106.694331][ T5338] print address description+0x55/0x1e0
[ 106.694343][ T5338] ? btrfs put root+0x2f/0x250
[ 106.694358][ T5338] print report+0x58/0x70
[ 106.
---truncated---
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Kernel