{"id":"CVE-2026-99067","title":"btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n\nWhen paths_from_inode() fails, scrub_print_warning_inode() jumps to err\nwithout dropping the…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 558540c17771eaf89b1a3be39aa2c8bc837da1a6 < 41cabfbf3532e2a2a17be9e4876042a5393b5c8d","Linux >= 558540c17771eaf89b1a3be39aa2c8bc837da1a6 < 452a435b74f7f598a343c51f7c89c5d2244384b6","Linux >= 558540c17771eaf89b1a3be39aa2c8bc837da1a6 < 12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549","Linux >= 558540c17771eaf89b1a3be39aa2c8bc837da1a6 < a7e5992bc37088f9b00e531955022aef69de3dc7","Linux >= 558540c17771eaf89b1a3be39aa2c8bc837da1a6 < 1fd742c7479961da6d0bb794ef8ac6b7b9442847","Linux 3.2"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:23:10.430Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99067","references":[{"url":"https://git.kernel.org/stable/c/41cabfbf3532e2a2a17be9e4876042a5393b5c8d"},{"url":"https://git.kernel.org/stable/c/452a435b74f7f598a343c51f7c89c5d2244384b6"},{"url":"https://git.kernel.org/stable/c/12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549"},{"url":"https://git.kernel.org/stable/c/a7e5992bc37088f9b00e531955022aef69de3dc7"},{"url":"https://git.kernel.org/stable/c/1fd742c7479961da6d0bb794ef8ac6b7b9442847"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.516Z","slug":"CVE-2026-99067","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n\nWhen paths_from_inode() fails, scrub_print_warning_inode() jumps to err\nwithout dropping the reference taken by btrfs_get_fs_root(), leaking a\nreference to the root every time path resolution fails while printing\nscrub warnings.  Every other error and success path of the function\ndrops the reference.\n\nDrop the reference on the paths_from_inode() failure path too.\n\n## Affected\n\n- `Linux >= 558540c17771eaf89b1a3be39aa2c8bc837da1a6 < 41cabfbf3532e2a2a17be9e4876042a5393b5c8d`\n- `Linux >= 558540c17771eaf89b1a3be39aa2c8bc837da1a6 < 452a435b74f7f598a343c51f7c89c5d2244384b6`\n- `Linux >= 558540c17771eaf89b1a3be39aa2c8bc837da1a6 < 12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549`\n- `Linux >= 558540c17771eaf89b1a3be39aa2c8bc837da1a6 < a7e5992bc37088f9b00e531955022aef69de3dc7`\n- `Linux >= 558540c17771eaf89b1a3be39aa2c8bc837da1a6 < 1fd742c7479961da6d0bb794ef8ac6b7b9442847`\n- `Linux 3.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}