CVE-2026-89645

A flaw was found in the btrfs file system in the Linux kernel. During relocation recovery, if an error occurs, such as a memory allocation failure, the system may not properly drop references to relocation roots. This oversight can lead to resource exhaustion, potentially allowing a local attacker to cause a denial of service (DoS) by making the system unresponsive or unstable.

A low impact denial of service flaw was found in the btrfs file system in the Linux kernel. During relocation recovery, if loading or adding a later root fails, or if the first transaction commit fails (for example, due to a memory allocation error), btrfs_recover_relocation() exits without clearing fs_root->reloc_root pointers or dropping the references owned by those pointers. Because mount-time cleanup only drops these references when the file system error flag is set, a failed recovery can leave references to relocation roots behind, leading to kernel resource exhaustion. A local attacker who can trigger an error during btrfs relocation recovery could exploit this to cause a denial of service, making the system unresponsive or unstable; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 5 are affected, and the fix for these streams is currently deferred; the residual risk is limited to local availability, consistent with the low impact rating. Red Hat Enterprise Linux 7, 8, and 9 and OpenShift Container Platform 4 are not affected because the vulnerable code is not present in those kernel versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.