« Volver al listado

CVE-2026-93798

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix reloc root cleanup in merge_reloc_roots()

If the root we got has zero root refs in its root item, we are resetting the root's ->reloc_root without using barriers like we do everywhere else. Sashiko complained about this while reviewing another patch, and it's correct (see the Link tag below).

Also, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless the root points to the reloc root we have.

Fix this by using clear_reloc_root(), which issues the memory barrier after setting the root's ->reloc_root to NULL and before clearing the bit BTRFS_ROOT_DEAD_RELOC_TREE from the root.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad en kernel Linux (AV:L/PR:L) que permite escalada/manipulación de privilegios mediante race condition en manejo de memoria; impacta disponibilidad (DoS) e integridad de datos de sistema de archivos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93798",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
              "lessThan": "29531470b1bf1e8bd2df4941fe913106edbca615",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
              "lessThan": "415f8665a969d3c906e4fd7c90fcbb4b357886f6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
              "lessThan": "ee695a968aa73b1e67ccbf2133dc0e54381d32b2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
              "lessThan": "0bc25f0a2d1b3e0a691431c4d7aef36afcd527c5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
              "lessThan": "ab48583aa9948205ff9a6470e23dbff74c565e24",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
              "lessThan": "63d6b1f04cd91c825329712aa526215ffa5d11ca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1dae7e0e58b484eaa43d530f211098fdeeb0f404",
              "lessThan": "b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee08663380ffd5a45a1c87580fbc305e8413c235",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33823378ff2b510fd7b566f25bb18438aeb9b23b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.4.54",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.7.11",
              "lessThan": "5.8",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "fs/btrfs/relocation.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/btrfs/relocation.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-24T17:17:12.607",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0bc25f0a2d1b3e0a691431c4d7aef36afcd527c5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/29531470b1bf1e8bd2df4941fe913106edbca615",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/415f8665a969d3c906e4fd7c90fcbb4b357886f6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/63d6b1f04cd91c825329712aa526215ffa5d11ca",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ab48583aa9948205ff9a6470e23dbff74c565e24",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ee695a968aa73b1e67ccbf2133dc0e54381d32b2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix reloc root cleanup in merge_reloc_roots()\n\nIf the root we got has zero root refs in its root item, we are resetting\nthe root's ->reloc_root without using barriers like we do everywhere else.\nSashiko complained about this while reviewing another patch, and it's\ncorrect (see the Link tag below).\n\nAlso, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless\nthe root points to the reloc root we have.\n\nFix this by using clear_reloc_root(), which issues the memory barrier\nafter setting the root's ->reloc_root to NULL and before clearing the bit\nBTRFS_ROOT_DEAD_RELOC_TREE from the root."
    }
  ],
  "lastModified": "2026-10-03T11:17:49.337",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}