CVE-2026-68422

What it actually does

Missing btrfs_put_root() call in merge_reloc_roots() leaves a reference on an unexpected reloc_root, causing a kernel memory leak within the Btrfs filesystem code.

Why it matters to the business

Long-running systems using Btrfs may experience gradual memory exhaustion, increasing operational costs for monitoring, restarts, and potential service degradation under sustained filesystem activity.

How an attack unfolds

An attacker triggers relocation operations that produce an unexpected reloc_root for a given root; the code jumps to the out label without dropping the obtained reference, accumulating leaked kernel memory over repeated triggers.

How to fix it

Apply the upstream kernel patch that adds the missing btrfs_put_root() call in merge_reloc_roots(); rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Verify the presence of the btrfs_put_root() call in the merge_reloc_roots() function in the running kernel source or confirm the kernel version contains the commit that resolves the root leak.

Typical attack path

1. Gain local access or execute code that can perform Btrfs relocation or balance operations
2. Force conditions that produce unexpected reloc_roots during merge_reloc_roots() execution
3. Repeat the triggering sequence to accumulate unreleased root references
4. Monitor for memory pressure or OOM conditions resulting from the accumulated leaks

How to detect it

Review kernel memory usage and slab allocator statistics over time for unexpected growth correlated with Btrfs relocation activity; examine kernel logs for repeated merge_reloc_roots paths.

What your security team should do

• Prioritize kernel updates on all systems running Btrfs
• Monitor memory usage trends on Btrfs hosts for unexpected growth
• Test the patched kernel in staging environments before broad deployment
• Review Btrfs usage patterns to reduce exposure to relocation operations if patching is delayed