CVE-2026-68450: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68450 is a memory leak vulnerability in the Linux kernel's btrfs subsystem, specifically within the __add_reloc_root() function. When rb_simple_insert() encounters a duplicate relocation root entry, it returns the existing node without inserting the newly allocated mapping_node, and the error path returns -EEXIST without freeing the new allocation. Because the node was never inserted into reloc_root_tree, the cleanup function put_reloc_control() cannot locate and free it, resulting in a kernel memory leak. The vulnerability affects Linux kernel versions from 5.13 up to fixed releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. It was published on August 12, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). In __add_reloc_root(), a mapping_node is allocated and passed to rb_simple_insert() for insertion into the red-black tree rc->reloc_root_tree. If a duplicate key already exists, rb_simple_insert() returns the existing node and leaves the new allocation unlinked — neither inserted into the tree nor tracked elsewhere. The subsequent error return of -EEXIST exits without calling kfree() on the new node, and since it was never added to the tree, the later put_reloc_control() cleanup cannot find or free it. The fix adds a kfree() call on the newly allocated node before returning -EEXIST. Exploitation requires local access and the ability to trigger btrfs relocation operations, such as through filesystem mount or administrative btrfs commands (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a local user to cause a kernel memory leak by repeatedly triggering the duplicate reloc root insert path in the btrfs subsystem. Over time, this can exhaust kernel memory, leading to system instability or a crash (denial of service). There is no impact on confidentiality or integrity; the availability impact is high in scenarios where memory exhaustion is achieved (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. Exploitation requires local access and the ability to perform btrfs relocation operations, which limits the attack surface to privileged or trusted local users (GitHub Advisory).

Apply the kernel patch available via the GitHub Advisory (GHSA-mmwm-g85r-pjj6). Fixed versions include Linux kernel 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. As a workaround, restrict access to btrfs mount operations and administrative btrfs commands to trusted users only, and monitor kernel memory usage on systems running btrfs to detect potential memory exhaustion (GitHub Advisory, Red Hat Bugzilla).