CVE-2026-89645

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the btrfs component during relocation recovery where fs roots maintain references to their relocation roots even after a recovery failure. Specifically, if loading a subsequent root fails or the first transaction commit fails, the btrfs recover relocation() function jumps to out unset before executing merge reloc roots() and clean dirty subvols(). While put reloc control() drops list-owned references, it fails to clear fs root->reloc root or drop references owned by those pointers. Consequently, errors such as -ENOMEM during root processing can leave orphaned references behind, as mount cleanup only drops them when BTRFS FS ERROR is set.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.