CVE-2026-89645 Overview
CVE-2026-89645 is a resource management flaw in the Linux kernel Btrfs filesystem, specifically in the relocation recovery path. During relocation recovery, each filesystem root acquires a reference to its relocation root. When loading or adding a later root fails, or when the first transaction commit fails, btrfs_recover_relocation() jumps to the out_unset label before merge_reloc_roots() and clean_dirty_subvols() execute. The cleanup path fails to clear fs_root->reloc_root or drop the associated references, leaking kernel object references during mount failure scenarios.
Critical Impact
An error such as -ENOMEM while processing a later root leaves stale relocation root references behind, causing reference counting inconsistencies in the Btrfs filesystem stack.
Affected Products
- Linux kernel Btrfs subsystem (versions prior to the fixing commits)
- Distributions shipping affected stable kernel branches
- Systems using Btrfs with pending-relocation images
Discovery Timeline
- 2026-09-11 - CVE-2026-89645 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89645
Vulnerability Analysis
The vulnerability resides in the Btrfs relocation recovery code path within the Linux kernel. During recovery, btrfs_recover_relocation() associates each filesystem root with its corresponding relocation root and increments the reference count. If a subsequent operation fails, control jumps to the out_unset cleanup label, bypassing the normal merge_reloc_roots() and clean_dirty_subvols() paths that would ordinarily drop these references.
The existing put_reloc_control() function drops list-owned relocation root references but does not clear the fs_root->reloc_root pointer or drop references owned by those pointers. Mount cleanup only reclaims these references when the BTRFS_FS_ERROR flag is set, so recoverable errors during mount leave dangling reference counts. Fault injection on a pending-relocation image with an injected first-commit failure confirmed 25 filesystem roots retained reloc_root pointers while fs_error was cleared to zero.
Root Cause
The root cause is incomplete cleanup logic in the error path of btrfs_recover_relocation(). The code establishes references to relocation roots without maintaining sufficient tracking to release them across all failure modes, leading to reference leaks classified as an improper resource release condition.
Attack Vector
Exploitation requires triggering an allocation failure or a first transaction commit failure during Btrfs mount recovery on a filesystem image with pending relocation state. The condition is primarily reachable during local mount operations. The immediate impact is kernel memory reference leakage rather than remote exploitation, though repeated failure conditions may contribute to resource exhaustion or unstable filesystem state after mount failures.
The fix keeps temporary references to the filesystem roots associated during recovery. On failure, the patched code clears their reloc_root pointers and drops the corresponding references. Once the first transaction commit succeeds, the code drops only the temporary filesystem root references and allows the normal merge and cleanup paths to handle the relocation roots. See the upstream commits for full details.
Detection Methods for CVE-2026-89645
Indicators of Compromise
- Kernel logs showing repeated Btrfs mount failures accompanied by -ENOMEM or transaction commit errors during relocation recovery
- Filesystem roots with non-null reloc_root pointers observed when fs_error is zero after a failed mount attempt
- Increased slab memory consumption tied to Btrfs root objects following mount failure loops
Detection Strategies
- Audit installed kernel versions against the fixing commits 2256d6d, 4d43107, 6d8ba45, and 8a64bae on git.kernel.org
- Monitor dmesg output for Btrfs relocation recovery errors on systems mounting filesystems with pending relocation state
- Correlate mount failure events with subsequent kernel memory pressure to identify reference leak symptoms
Monitoring Recommendations
- Track kernel version inventory across Linux endpoints and servers to identify unpatched Btrfs implementations
- Alert on repeated Btrfs mount failures in system logs, particularly during automated recovery workflows
- Ingest kernel and syslog telemetry into a centralized data platform for longitudinal analysis of filesystem stability
How to Mitigate CVE-2026-89645
Immediate Actions Required
- Update affected Linux kernels to versions containing the fixing commits referenced in the kernel.org stable tree
- Prioritize patching on systems using Btrfs as the root or data filesystem where relocation is in active use
- Review backup and recovery procedures to avoid repeated mount attempts on filesystems with pending relocation state until patched
Patch Information
The fix is available in the upstream Linux kernel via commits Kernel Git Commit 2256d6d, Kernel Git Commit 4d43107, Kernel Git Commit 6d8ba45, and Kernel Git Commit 8a64bae. Apply the corresponding stable kernel updates from your Linux distribution vendor.
Workarounds
- Avoid mounting Btrfs filesystems with pending relocation state on unpatched kernels when memory pressure is high
- Where feasible, complete relocation operations cleanly before performing kernel maintenance or reboots
- Consider alternate filesystems for workloads that cannot tolerate mount recovery failures until the patch is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.