CVE-2026-93800

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()

If during relocation we fail in insert_dirty_subvol() because

btrfs_update_reloc_root() returned an error, we will leave a root's

reloc_root field pointing to a reloc root that was freed instead of NULL,

resulting later in a use-after-free, or double free attempt during

unmount.

The sequence of steps is this:

1) During relocation the call to btrfs_update_reloc_root() in

insert_dirty_subvol() fails, so insert_dirty_subvol() returns the

error to merge_reloc_root() without adding the root to the list

rc->dirty_subvol_roots;

2) Then merge_reloc_root() aborts the current transaction because

insert_dirty_subvol() returned an error;

3) Up the call chain, merge_reloc_roots() gets the error, adds the

reloc root for root X to the local reloc_roots list and jumps to the

'out' label, where it calls free_reloc_roots() to free all th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References