{"id":"CVE-2026-93798","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix reloc root cleanup in merge_reloc_roots()\n\nIf the root we got has zero root refs in its root item, we are resetting\nthe root's ->reloc_root without using bar…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix reloc root cleanup in merge_reloc_roots()\n\nIf the root we got has zero root refs in its root item, we are resetting\nthe root's ->reloc_root without using bar…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ab48583aa9948205ff9a6470e23dbff74c565e24","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 63d6b1f04cd91c825329712aa526215ffa5d11ca","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8","Linux < 6.12.111","Linux < 6.18.53","Linux (all versions)"],"published":"2026-09-24","updated":"2026-09-25","sourceUpdated":"2026-09-25T05:17:03.073","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93798","references":[{"url":"https://git.kernel.org/stable/c/63d6b1f04cd91c825329712aa526215ffa5d11ca","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab48583aa9948205ff9a6470e23dbff74c565e24","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-24T16:47:15.899Z","slug":"CVE-2026-93798","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix reloc root cleanup in merge_reloc_roots()\n\nIf the root we got has zero root refs in its root item, we are resetting\nthe root's ->reloc_root without using barriers like we do everywhere else.\nSashiko complained about this while reviewing another patch, and it's\ncorrect (see the Link tag below).\n\nAlso, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless\nthe root points to the reloc root we have.\n\nFix this by using clear_reloc_root(), which issues the memory barrier\nafter setting the root's ->reloc_root to NULL and before clearing the bit\nBTRFS_ROOT_DEAD_RELOC_TREE from the root.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":210551,"id":"CVE-2026-93798","ts":1790316054724,"field":"cvss","old":null,"new":"7.8"},{"seq":210550,"id":"CVE-2026-93798","ts":1790316054724,"field":"severity","old":"none","new":"high"}]}