Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reloc root cleanup in merge_reloc_roots() If the root we got has zero root refs in its root item, we are resetting the root's ->reloc_root without using barriers like we do everywhere else. Sashiko complained about this while reviewing another patch, and it's correct (see the Link tag below). Also, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless the root points to the reloc root we have. Fix this by using clear_reloc_root(), which issues the memory barrier after setting the root's ->reloc_root to NULL and before clearing the bit BTRFS_ROOT_DEAD_RELOC_TREE from the root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-24T17:17:12.607Z",
  "pubdate": "2026-09-24T17:17:12.607Z",
  "executiveSummary": "The vulnerability is a race condition within the Btrfs filesystem driver's relocation root management logic, specifically located in the merge_reloc_roots() function.\nThe flaw stems from the improper handling of memory barriers when resetting a root's reloc_root pointer and an incorrect state transition for the BTRFS_ROOT_DEAD_RELOC_TREE bit.\nThe vulnerability affects the Linux kernel's Btrfs implementation. If exploited, it can lead to memory inconsistency, potential kernel panics, or filesystem corruption during the relocation process.\nAttackers with local access to a system utilizing Btrfs could potentially trigger this race condition, though successful exploitation typically requires specific timing during filesystem maintenance tasks such as background relocation or snapshots.\nThe risk is categorized as moderate due to the complexity of the race condition, but it poses significant concerns for data integrity in environments relying heavily on Btrfs features like subvolume relocation or balance operations.",
  "technicalDetails": "The vulnerability originates in the merge_reloc_roots() function within the Btrfs kernel module. During the processing of relocation roots, the kernel identifies roots that possess zero references in their root items, signifying they are candidates for cleanup.\nPreviously, the implementation performed a direct assignment to reset the root's ->reloc_root member to NULL without implementing the necessary memory barriers. This lack of synchronization creates a race condition where other CPU cores may perceive the reloc_root pointer update out of sequence with the associated metadata changes.\nFurthermore, the logic incorrectly cleared the BTRFS_ROOT_DEAD_RELOC_TREE bit from the root without verifying that the root actually pointed to the specific reloc root currently being processed. This decoupling of the state bit from the pointer value leads to a mismatch in the internal state machine of the Btrfs root object.\nThe fix involves the implementation of the clear_reloc_root() helper function. This function ensures that the memory barrier is issued specifically after the root's ->reloc_root is set to NULL and before the BTRFS_ROOT_DEAD_RELOC_TREE bit is cleared. By enforcing this memory ordering, the kernel ensures that any concurrent reads of the reloc_root structure observe a consistent state, preventing partial updates or stale pointer dereferences.\nThe attack flow relies on an attacker initiating operations that trigger relocation, such as a 'btrfs balance' command, while simultaneously performing metadata-intensive tasks. If an attacker can successfully trigger the race condition, they might cause the kernel to access a freed or partially initialized reloc root structure. The resulting behavior could lead to a kernel oops, a system-wide crash, or the writing of inconsistent data blocks to the physical medium.\nBecause this occurs in the kernel space, any exploitation results in immediate system instability or potential local privilege escalation if memory corruption primitives can be reliably constructed from the race. The primary vulnerable component is the memory synchronization logic in fs/btrfs/relocation.c, affecting kernel versions where this specific implementation of root cleanup is present."
}