{"schema":"threatline.record/2","record":{"id":"CVE-2026-93800","aliases":[],"summary":"btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()\n\nIf during relocation we fail in insert_dirty_subvol() because\nbtrfs_update_reloc_root() returned an error, we will leave a root's\nreloc_root field pointing to a reloc root that was freed instead of NULL,\nresulting later in a use-after-free, or double free attempt during\nunmount.\n\nThe sequence of steps is this:\n\n1) During relocation the call to btrfs_update_reloc_root() in\n   insert_dirty_subvol() fails, so insert_dirty_subvol() returns the\n   error to merge_reloc_root() without adding the root to the list\n   rc->dirty_subvol_roots;\n\n2) Then merge_reloc_root() aborts the current transaction because\n   insert_dirty_subvol() returned an error;\n\n3) Up the call chain, merge_reloc_roots() gets the error, adds the\n   reloc root for root X to the local reloc_roots list and jumps to the\n   'out' label, where it calls free_reloc_roots() to free all the reloc\n   roots in the local reloc_roots list. This frees the reloc root for\n   root X;\n\n4) We go up the call chain to relocate_block_group() which calls\n   clean_dirty_subvols() to go over dirty roots and set their\n   ->reloc_root field to NULL, but root X is not in the dirty_subvol_roots\n   list, so its ->reloc_root still points to a reloc root;\n\n5) Relocation finishes, with an error and a transaction abort, but the\n   ->reloc_root field for root X still points to the reloc root that was\n   freed in step 3;\n\n6) When unmounting the fs we end up calling:\n\n     btrfs_free_fs_roots()\n        btrfs_drop_and_free_fs_root()\n           --> calls btrfs_put_root() against root X's ->reloc_root\n               which is not NULL and points to the already freed\n               reloc root in step 4 above\n\n  Resulting in a use-after-free to a double free attempt.\n\nSyzbot reported this with the following dmesg/syslog:\n\n   [  106.004389][ T5339] BTRFS error (device loop0 state A): Transaction aborted (error -5)\n   [  106.014266][ T5339] BTRFS: error (device loop0 state A) in merge_reloc_root:1655: errno=-5 IO failure\n   [  106.021891][ T1061] BTRFS error (device loop0 state A): error while writing out transaction: -5\n   [  106.026964][ T1061] BTRFS warning (device loop0 state A): Skipping commit of aborted transaction.\n   [  106.033807][ T5340] BTRFS error (device loop0 state A): bdev /dev/loop0 errs: wr 3, rd 0, flush 0, corrupt 0, gen 0\n   [  106.039265][ T1061] BTRFS: error (device loop0 state A) in cleanup_transaction:2067: errno=-5 IO failure\n   [  106.044382][ T5339] BTRFS info (device loop0 state EA): forced readonly\n   [  106.074329][ T5339] BTRFS: error (device loop0 state EA) in merge_reloc_roots:1887: errno=-5 IO failure\n   [  106.081004][ T5356] BTRFS info (device loop0 state EA): scrub: started on devid 1\n   [  106.085611][ T5339] BTRFS info (device loop0 state EA): balance: ended with status: -30\n   [  106.089517][ T5356] BTRFS info (device loop0 state EA): scrub: not finished on devid 1 with status: -30\n   [  106.662365][ T5338] BTRFS info (device loop0 state EA): last unmount of filesystem 3a375e4e-b156-4d76-a2ad-16e198ce1409\n   [  106.682946][ T5338] ==================================================================\n   [  106.686574][ T5338] BUG: KASAN: slab-use-after-free in btrfs_put_root+0x2f/0x250\n   [  106.690090][ T5338] Write of size 4 at addr ffff88803f978630 by task syz.0.0/5338\n   [  106.693173][ T5338]\n   [  106.694279][ T5338] CPU: 0 UID: 0 PID: 5338 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)\n   [  106.694293][ T5338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n   [  106.694300][ T5338] Call Trace:\n   [  106.694308][ T5338]  <TASK>\n   [  106.694314][ T5338]  dump_stack_lvl+0xe8/0x150\n   [  106.694331][ T5338]  print_address_description+0x55/0x1e0\n   [  106.694343][ T5338]  ? btrfs_put_root+0x2f/0x250\n   [  106.694358][ T5338]  print_report+0x58/0x70\n   [  106.\n---truncated---","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93800","source_modified_at":"2026-10-03T10:57:34.733Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Linux","vendor":"Linux","versions":[{"version":"f32b84d7c977e1906a4781b93b3c93090b6cd675","lessThan":"5a247097c5f94b51ffc991b444d998ad6e85875f","status":"affected","versionType":"git"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"6372dd394ea907cd85a7a8063db320ec73dfaed0","status":"affected","versionType":"git"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"9f599d120b2b79d2d937c3935b7cdf2697514283","status":"affected","versionType":"git"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"a01837ae174a2a968c245a30e6dd010f50eaf05d","status":"affected","versionType":"git"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"97a540d72ebcb21853d11f2a56782fe377f358e7","status":"affected","versionType":"git"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"fda1b6636ff1846f00643e791099db5564b547d9","status":"affected","versionType":"git"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"83201804efa4a5168be754e1dfc9b2faee760cac","status":"affected","versionType":"git"},{"version":"aa18bc1ff8a51f082d5b3b6d07693797637b4028","status":"affected","versionType":"git"},{"version":"4cb0aea2e250eee35ccfac5f5395cd8f3238a9e5","status":"affected","versionType":"git"},{"version":"5.10.36","lessThan":"5.10.271","status":"affected","versionType":"semver"},{"version":"5.11.20","lessThan":"5.12","status":"affected","versionType":"semver"},{"version":"5.12.3","lessThan":"5.13","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93800","source_modified_at":"2026-10-03T10:57:34.733Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","status":"unaffected","versionType":"semver"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93800","source_modified_at":"2026-10-03T10:57:34.733Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"5a247097c5f94b51ffc991b444d998ad6e85875f","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93800","source_modified_at":"2026-10-03T10:57:34.733Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"6372dd394ea907cd85a7a8063db320ec73dfaed0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93800","source_modified_at":"2026-10-03T10:57:34.733Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"9f599d120b2b79d2d937c3935b7cdf2697514283","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93800","source_modified_at":"2026-10-03T10:57:34.733Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"97a540d72ebcb21853d11f2a56782fe377f358e7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93800","source_modified_at":"2026-10-03T10:57:34.733Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"83201804efa4a5168be754e1dfc9b2faee760cac","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93800","source_modified_at":"2026-10-03T10:57:34.733Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"5.10.271","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93800","source_modified_at":"2026-10-03T10:57:34.733Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"5.12","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93800","source_modified_at":"2026-10-03T10:57:34.733Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"5.13","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00173,"percentile":0.06355,"score_date":"2026-10-23"},"published_at":"2026-09-24T16:02:34.370Z","modified_at":"2026-10-03T10:57:34.733Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-93800","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-03T10:57:34.733Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93800","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/5a247097c5f94b51ffc991b444d998ad6e85875f"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/6372dd394ea907cd85a7a8063db320ec73dfaed0"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/9f599d120b2b79d2d937c3935b7cdf2697514283"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/a01837ae174a2a968c245a30e6dd010f50eaf05d"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/97a540d72ebcb21853d11f2a56782fe377f358e7"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/fda1b6636ff1846f00643e791099db5564b547d9"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/83201804efa4a5168be754e1dfc9b2faee760cac"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-03T10:57:34.733Z","content_hash":"1da405fd99aec6f0be1d9665d84a28c5e1182a7150df2dda97c273c616a9e0f7"}}