{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68450", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.395Z", "datePublished": "2026-08-12T00:51:48.970Z", "dateUpdated": "2026-08-12T00:51:48.970Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-12T00:51:48.970Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free mapping node on duplicate reloc root insert\n\n__add_reloc_root() allocates a mapping_node before inserting it into\nrc->reloc_root_tree. If rb_simple_insert() finds an existing entry, it\nreturns the existing rb_node and leaves the newly allocated node unlinked.\n\nThe error path then returns -EEXIST without freeing the new node. Since\nthe node was never inserted into reloc_root_tree, the later cleanup in\nput_reloc_control() cannot find it either.\n\nFree the newly allocated node before returning -EEXIST.\n\nThe callers currently assert that -EEXIST should not happen, so this is a\ndefensive cleanup for an unexpected duplicate insert path. If the path is\never reached, the local allocation should still be released."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/relocation.c"], "versions": [{"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068", "lessThan": "92bedc0455552b42ada1a1f42b0e3a8593cdfccc", "status": "affected", "versionType": "git"}, {"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068", "lessThan": "14a8be9428435ee17f17fae7991215c246b7fd43", "status": "affected", "versionType": "git"}, {"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068", "lessThan": "797dc567146c7e3c4f8d9680e4fbc76e0a6d9151", "status": "affected", "versionType": "git"}, {"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068", "lessThan": "ae0629ff9ccb836416ada129f4edc7efea6eaaad", "status": "affected", "versionType": "git"}, {"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068", "lessThan": "6a8269b6459ed870a8156c106a0f597383907872", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/relocation.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2-rc5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/92bedc0455552b42ada1a1f42b0e3a8593cdfccc"}, {"url": "https://git.kernel.org/stable/c/14a8be9428435ee17f17fae7991215c246b7fd43"}, {"url": "https://git.kernel.org/stable/c/797dc567146c7e3c4f8d9680e4fbc76e0a6d9151"}, {"url": "https://git.kernel.org/stable/c/ae0629ff9ccb836416ada129f4edc7efea6eaaad"}, {"url": "https://git.kernel.org/stable/c/6a8269b6459ed870a8156c106a0f597383907872"}], "title": "btrfs: free mapping node on duplicate reloc root insert", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/btrfs/relocation.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "92bedc0455552b42ada1a1f42b0e3a8593cdfccc", "status": "affected", "version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068", "versionType": "git"}, {"lessThan": "14a8be9428435ee17f17fae7991215c246b7fd43", "status": "affected", "version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068", "versionType": "git"}, {"lessThan": "797dc567146c7e3c4f8d9680e4fbc76e0a6d9151", "status": "affected", "version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068", "versionType": "git"}, {"lessThan": "ae0629ff9ccb836416ada129f4edc7efea6eaaad", "status": "affected", "version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068", "versionType": "git"}, {"lessThan": "6a8269b6459ed870a8156c106a0f597383907872", "status": "affected", "version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/btrfs/relocation.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc5", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free mapping node on duplicate reloc root insert\n\n__add_reloc_root() allocates a mapping_node before inserting it into\nrc->reloc_root_tree. If rb_simple_insert() finds an existing entry, it\nreturns the existing rb_node and leaves the newly allocated node unlinked.\n\nThe error path then returns -EEXIST without freeing the new node. Since\nthe node was never inserted into reloc_root_tree, the later cleanup in\nput_reloc_control() cannot find it either.\n\nFree the newly allocated node before returning -EEXIST.\n\nThe callers currently assert that -EEXIST should not happen, so this is a\ndefensive cleanup for an unexpected duplicate insert path. If the path is\never reached, the local allocation should still be released."}], "id": "CVE-2026-68450", "lastModified": "2026-08-12T01:17:07.930", "metrics": {}, "published": "2026-08-12T01:17:07.930", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/14a8be9428435ee17f17fae7991215c246b7fd43"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6a8269b6459ed870a8156c106a0f597383907872"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/797dc567146c7e3c4f8d9680e4fbc76e0a6d9151"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/92bedc0455552b42ada1a1f42b0e3a8593cdfccc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae0629ff9ccb836416ada129f4edc7efea6eaaad"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: btrfs: free mapping node on duplicate reloc root insert", "id": "2514461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514461"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's btrfs filesystem. When the `__add_reloc_root()` function attempts to insert a duplicate mapping node into the `reloc_root_tree`, the newly allocated node is not properly freed. This oversight can lead to a memory leak, potentially causing resource exhaustion and a Denial of Service (DoS) over an extended period if this unexpected path is triggered."], "mitigation": {"lang": "en:us", "value": "There is no mitigation for this flaw. Systems not using btrfs filesystems are not affected in practice, as the vulnerable code path is only reached during btrfs block group relocation operations."}, "name": "CVE-2026-68450", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68450\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68450\nhttps://lore.kernel.org/linux-cve-announce/2026081225-CVE-2026-68450-e589@gregkh/T"], "statement": "Red Hat has determined that this vulnerability does not pose a significant risk. The memory leak occurs on a defensive error path that upstream callers assert should never be reached, and triggering btrfs relocation requires administrative privileges. Red Hat may apply this fix in a future kernel update.", "threat_severity": "Low"}

{}