Skip to main content

Linux Kernel EUVDEUVD-2026-86185

| CVE-2026-93798 HIGH
2026-09-24 Linux GHSA-9c2v-whhq-6g24
Linux Red Hat Suse
High
Disputed · 7.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privileged access
  2. Delivery
    Trigger btrfs relocation via balance/device op
  3. Exploit
    Race the unbarriered reloc_root reset
  4. Execution
    Dereference stale pointer on weak-ordering arch
  5. Impact
    Kernel oops / potential instability

Vulnerability Assessment

Exploitation Conditions

Requires local access to a system using a btrfs filesystem AND active btrfs block-group relocation being in progress (driven by a balance operation or device add/remove/replace), which is typically an administrative action. The race is only meaningfully exploitable on weakly-ordered CPU architectures where the missing memory barrier allows observation of a stale root->reloc_root pointer; on strongly-ordered x86 the window is largely benign. There is no remote vector and no default-configuration exposure - btrfs must be in use and relocation must be triggered.
Impact

This is a high-CVSS-but-low-real-risk issue. NVD/Linux assign 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but that vector is inflated for what the patch describes: a missing memory barrier and an over-broad flag clear in btrfs merge_reloc_roots() - a concurrency/memory-ordering defect (effectively CWE-362, with a possible stale-pointer window), not a confidential data leak with full triple-impact. There is no EPSS score, no CISA KEV listing, and no public exploit code, so all exploitation signals are absent. The realistic ceiling is a race-triggered crash on weakly-ordered architectures, not code execution or disclosure; my independent estimate is ~3.3 (AV:L/AC:H/PR:L/C:N/I:L/A:L). CONFLICT TO NOTE: the C:H/I:H impacts in the input vector are not supported by the description, and the 'Information Disclosure' tag contradicts the actual defect class - verify impact with the maintainer/NVD before treating as high priority. Triggering the code path requires actively driving btrfs relocation (via balance or device add/remove/replace), which is an administrative operation, further limiting real-world reachability.
Exploit ScenarioDerived

An attacker with local access on a system using btrfs would need to induce block-group relocation (e.g., during a filesystem balance or device operation) and win a narrow timing race where root->reloc_root is reset without the proper memory barrier, potentially reading a stale pointer on a weakly-ordered CPU. The most plausible outcome is a kernel crash/oops rather than controlled memory corruption. No public exploit code exists, and reliably winning this race in practice is unproven.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

A race condition in the btrfs filesystem's relocation code (merge_reloc_roots() in fs/btrfs/relocation.c) allows a local user with an active balance or device add/remove/replace operation in progress to observe an inconsistent root->reloc_root pointer because the code clears that pointer without the memory barrier used elsewhere in the same code path. The affected code also clears the BTRFS_ROOT_DEAD_RELOC_TREE flag even when the root no longer points at the reloc root being cleaned up, so cleanup can target the wrong reloc root. The upstream fix routes cleanup through clear_reloc_root(), which issues the barrier after nulling ->reloc_root and before clearing the flag. Our independent assessment rates this far below the vendor-published CVSS 7.8: it is a local, high-complexity race that requires btrfs to be in active use and block-group relocation to be underway, is only meaningfully exploitable on weakly-ordered CPU architectures, and yields at most low integrity and availability impact with no confidentiality loss; there is no remote vector and no public exploit identified at time of analysis, and no KEV listing.

RemediationAI

Upgrade to a kernel that contains the fix: Linux 6.12.111 or later on the 6.12.y stable line, 6.18.53 or later on the 6.18.y line, or 7.2 or later on mainline (vendor-released patch versions per EUVD). Distribution kernels should be updated to the corresponding vendor errata, or the specific upstream commits 63d6b1f04cd91c825329712aa526215ffa5d11ca, b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8, and ab48583aa9948205ff9a6470e23dbff74c565e24 can be backported to older trees; reference https://nvd.nist.gov/vuln/detail/CVE-2026-93798 for tracking. Where immediate patching is not possible, the practical compensating control is to avoid triggering block-group relocation on unfixed kernels - defer btrfs balance operations and device add/remove/replace actions until the kernel is updated, with the trade-off that this delays legitimate capacity rebalancing and hardware migration on degraded or full filesystems and is impractical for automated maintenance scripts that run balances periodically. Because the race is only reliably observable on weakly-ordered architectures such as arm64 and powerpc, unfixed x86_64 systems carry substantially lower practical exposure, but this is not a substitute for patching since the defect also corrupts reloc-root bookkeeping state independent of ordering. There is no remote attack surface to firewall off and no configuration flag that disables this code path other than not using btrfs relocation features; restrict local access on multi-user systems as a secondary measure, and monitor dmesg for btrfs tree-checker or assertion failures following relocation activity as an indicator of prior corruption.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <63d6b1f04cd91c825329712aa526215ffa5d11ca
Linux 0 <6.18.53
Linux 0 <6.12.111
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <ab48583aa9948205ff9a6470e23dbff74c565e24
Linux patch: 7.2
Linux patch: 6.12.111
Linux patch: 6.18.53

Affected Packages

euvd linux fix: 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

btrfs relocation rewrites block-group references during balance and device add/remove/replace operations, building a temporary relocation root (reloc_root) and merging it back into the filesystem root tree in merge_reloc_roots(). The bug is a memory-ordering and state-flag defect: when the looked-up root has zero refs in its root item, the code resets root->reloc_root without the smp_wmb()-style barrier that other sites in the same path use, and it unconditionally clears BTRFS_ROOT_DEAD_RELOC_TREE even when the root does not point to the reloc root being processed. On weakly-ordered architectures (arm64, powerpc) a concurrent reader can therefore see a stale ->reloc_root or a flag state inconsistent with the pointer, leading to use of a freed/stale reloc root and resulting in incorrect tree state, filesystem corruption, or a crash. The patch replaces the open-coded sequence with clear_reloc_root(), which performs the store of NULL followed by a write barrier and only then clears the DEAD_RELOC_TREE bit, restoring the ordering discipline used throughout the relocation code. The CPE data (cpe:2.3:a:linux:linux) confirms this is a mainline Linux kernel component issue rather than a discrete third-party package; no CWE was supplied in the source data, but the defect class is best characterized as improper synchronization / missing memory barrier (CWE-362 race condition compounded by CWE-667 improper locking semantics) affecting btrfs internal root bookkeeping. The EUVD entry notes the flaw has existed since the original kernel git import commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, so all long-lived btrfs-enabled kernels in the affected ranges inherit it.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 3.6 LOW

Local-only race gated on admin-triggered btrfs relocation (AV:L/AC:H/PR:L); no disclosure (C:N), at most transient stale-pointer/crash effects (I:L/A:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE 4.1 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
7.8 (HIGH)
Patch available
Sep 24, 2026 - 17:03 EUVD
CVE Published
Sep 24, 2026 - 16:02 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 24, 2026 - 16:02 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix reloc root cleanup in merge_reloc_roots()

If the root we got has zero root refs in its root item, we are resetting the root's ->reloc_root without using barriers like we do everywhere else. Sashiko complained about this while reviewing another patch, and it's correct (see the Link tag below).

Also, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless the root points to the reloc root we have.

Fix this by using clear_reloc_root(), which issues the memory barrier after setting the root's ->reloc_root to NULL and before clearing the bit BTRFS_ROOT_DEAD_RELOC_TREE from the root.

Executive ViewAI

Why It Matters

Linux hosts that rely on the btrfs filesystem - particularly servers built on weakly-ordered CPU architectures such as ARM and POWER - may be exposed to an internal consistency flaw in filesystem relocation that a local user could trigger while a balance or device add/remove/replace operation is running. The practical blast radius is limited: exploitation requires local access, precise timing, and an active btrfs workload, and our independent analysis rates the realistic integrity and availability consequences as low, materially below the vendor's published 7.8 score. Leadership should prioritize remediation on multi-tenant or container hosts where untrusted local users share btrfs-backed storage.

Business Impact: Low
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 98% exploitable
Prevalence
Ubiquitous
Linux kernel is ubiquitous, though the btrfs relocation code path is niche
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93798 ADVISORY https://vuldb.com/vuln/409539 REF https://git.kernel.org/stable/c/0bc25f0a2d1b3e0a691431c4d7aef36afcd527c5 REF https://git.kernel.org/stable/c/29531470b1bf1e8bd2df4941fe913106edbca615 REF https://git.kernel.org/stable/c/415f8665a969d3c906e4fd7c90fcbb4b357886f6 REF https://git.kernel.org/stable/c/63d6b1f04cd91c825329712aa526215ffa5d11ca REF https://git.kernel.org/stable/c/ab48583aa9948205ff9a6470e23dbff74c565e24 REF https://git.kernel.org/stable/c/b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8 REF https://git.kernel.org/stable/c/ee695a968aa73b1e67ccbf2133dc0e54381d32b2

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy