CVE-2026-89645

In the Linux kernel, the following vulnerability has been resolved:

btrfs: drop recovered reloc root refs on recovery failure

During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails, btrfs recover relocation() jumps to out unset before merge reloc roots() and clean dirty subvols().

put reloc control() drops the list-owned relocation root references, but it does not clear fs root->reloc root or drop the references owned by those pointers. Mount cleanup only drops them when BTRFS FS ERROR is set, so an error such as -ENOMEM while processing a later root can leave references behind.

Keep temporary references to the fs roots associated during recovery. On failure, clear their reloc root pointers and drop the corresponding references. Once the first transaction commit succeeds, drop only the temporary fs root references and let the normal merge and cleanup paths handle the relocation roots.

Fault injection on a pending-relocation image confirmed the cleanup gap. With an injected first-commit failure, 25 fs roots had reloc root set with fs error=0. With this fix, the same failure path drops that count to 0 before mount fails.