{"id":"CVE-2026-68450","title":"btrfs: free mapping node on duplicate reloc root insert","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free mapping node on duplicate reloc root insert\n\n__add_reloc_root() allocates a mapping_node before inserting it into\nrc->reloc_root_tree.  If rb_simple_insert(…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < 29d9746812d8b7c37d594f484e994fd552c3ec33","Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < b7c5b8e1d5f0779dfbabc3068b7ac0f12e53b3a8","Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < 92bedc0455552b42ada1a1f42b0e3a8593cdfccc","Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < 14a8be9428435ee17f17fae7991215c246b7fd43","Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < 797dc567146c7e3c4f8d9680e4fbc76e0a6d9151","Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < ae0629ff9ccb836416ada129f4edc7efea6eaaad","Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < 6a8269b6459ed870a8156c106a0f597383907872","Linux 5.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:49:44.195694Z"},"published":"2026-08-12","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:17.167Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68450","references":[{"url":"https://git.kernel.org/stable/c/29d9746812d8b7c37d594f484e994fd552c3ec33"},{"url":"https://git.kernel.org/stable/c/b7c5b8e1d5f0779dfbabc3068b7ac0f12e53b3a8"},{"url":"https://git.kernel.org/stable/c/92bedc0455552b42ada1a1f42b0e3a8593cdfccc"},{"url":"https://git.kernel.org/stable/c/14a8be9428435ee17f17fae7991215c246b7fd43"},{"url":"https://git.kernel.org/stable/c/797dc567146c7e3c4f8d9680e4fbc76e0a6d9151"},{"url":"https://git.kernel.org/stable/c/ae0629ff9ccb836416ada129f4edc7efea6eaaad"},{"url":"https://git.kernel.org/stable/c/6a8269b6459ed870a8156c106a0f597383907872"}],"tags":["cve.org"],"epss":0.00161,"epssPercentile":0.05342,"ingestedAt":"2026-11-06T18:00:12.602Z","slug":"CVE-2026-68450","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free mapping node on duplicate reloc root insert\n\n__add_reloc_root() allocates a mapping_node before inserting it into\nrc->reloc_root_tree.  If rb_simple_insert() finds an existing entry, it\nreturns the existing rb_node and leaves the newly allocated node unlinked.\n\nThe error path then returns -EEXIST without freeing the new node.  Since\nthe node was never inserted into reloc_root_tree, the later cleanup in\nput_reloc_control() cannot find it either.\n\nFree the newly allocated node before returning -EEXIST.\n\nThe callers currently assert that -EEXIST should not happen, so this is a\ndefensive cleanup for an unexpected duplicate insert path.  If the path is\never reached, the local allocation should still be released.\n\n## Affected\n\n- `Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < 29d9746812d8b7c37d594f484e994fd552c3ec33`\n- `Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < b7c5b8e1d5f0779dfbabc3068b7ac0f12e53b3a8`\n- `Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < 92bedc0455552b42ada1a1f42b0e3a8593cdfccc`\n- `Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < 14a8be9428435ee17f17fae7991215c246b7fd43`\n- `Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < 797dc567146c7e3c4f8d9680e4fbc76e0a6d9151`\n- `Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < ae0629ff9ccb836416ada129f4edc7efea6eaaad`\n- `Linux >= 57a304cfd43b2b4a5b44b8f5dc026abb34183068 < 6a8269b6459ed870a8156c106a0f597383907872`\n- `Linux 5.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}