CVE-2026-93798

A flaw was found in the Linux kernel's Btrfs file system. A local user could exploit this flaw to cause a Denial of Service (DoS) by triggering system instability or a kernel crash. This issue is caused by missing memory barriers and improper state flag management during relocation root cleanup, which can lead to a race condition when resetting root references.

A flaw in the Linux kernel's Btrfs file system was rated by Red Hat Product Security as having LOW security impact. During relocation root cleanup in merge_reloc_roots(), when a root with zero root references was processed, the code reset the root's ->reloc_root pointer without the memory barriers used in other paths and cleared the BTRFS_ROOT_DEAD_RELOC_TREE state bit without verifying that the root pointed to the relocation root being cleaned up. This missing synchronization creates a race condition: a local user with the privileges required to trigger Btrfs relocation (balance) operations could win the race and cause system instability or a kernel crash, resulting in a denial of service limited to availability. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 kernels contain the vulnerable code and are marked affected; fixes for these streams are currently deferred, so the residual risk remains a local denial of service that requires privileged access and precise timing to trigger. Red Hat Enterprise Linux 7, 8, and 9 are not affected because the vulnerable code is not present, and OpenShift Container Platform RHEL CoreOS 8 and 9 nodes are not affected for the same reason. This differs from the upstream CVEORG severity of 7.8 (Important), which assumes high confidentiality and integrity impact; Red Hat's assessment finds only an availability impact from a local, privilege-requiring race condition with high attack complexity, consistent with the Red Hat CVSS score of 5.5 (Moderate).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.