CVE-2026-68422: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68422 is a reference count leak vulnerability in the Linux kernel's btrfs (B-tree filesystem) subsystem, specifically within the merge_reloc_roots() function. When an unexpected reloc_root is encountered, the function exits via the out label without releasing a previously obtained reference to the root object via btrfs_put_root(), resulting in a kernel memory leak. The vulnerability affects Linux kernel versions starting from 5.13 up to (but not including) the fixed stable releases. It was published on August 10, 2026, with patches available across multiple stable branches. The CVSS estimated severity is Medium, with an EPSS score of 0.0 (GitHub Advisory, Feedly).

The root cause is a missing btrfs_put_root() call in the error/unexpected-condition exit path of merge_reloc_roots() in the Linux kernel's btrfs subsystem (CWE-401: Missing Release of Memory after Effective Lifetime). When the function encounters an unexpected reloc_root for a given root object, it jumps to the out label for cleanup, but the reference count increment performed earlier for root is never decremented, causing a reference count leak. This is a local vulnerability requiring the ability to trigger btrfs filesystem relocation operations (e.g., via btrfs balance or similar operations that invoke relocation). The fix adds the missing btrfs_put_root() call before the jump to out to properly decrement the reference count (GitHub Advisory).

Successful exploitation causes kernel memory to not be freed, gradually exhausting available system memory over time. A local user with access to btrfs filesystem operations can repeatedly trigger the condition to accumulate leaked references, degrading system performance and potentially causing a denial-of-service condition as kernel memory is exhausted. There is no evidence of confidentiality or integrity impact; the primary risk is availability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access to a system running a vulnerable Linux kernel with btrfs filesystems in use. The EPSS score is 0.0, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

Apply the available kernel patches that add the missing btrfs_put_root() call in merge_reloc_roots(). Fixed versions include Linux kernel stable releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. Administrators should update to a patched kernel version as soon as possible. As a temporary workaround, avoiding btrfs balance/relocation operations on affected systems may reduce exposure, though upgrading is the recommended remediation (GitHub Advisory, Feedly).