{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "1dae7e0e58b484eaa43d530f211098fdeeb0f404"
            },
            {
              "fixed": "ab48583aa9948205ff9a6470e23dbff74c565e24"
            },
            {
              "fixed": "63d6b1f04cd91c825329712aa526215ffa5d11ca"
            },
            {
              "fixed": "b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "ee08663380ffd5a45a1c87580fbc305e8413c235"
            },
            {
              "last_affected": "33823378ff2b510fd7b566f25bb18438aeb9b23b"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.4.54"
            },
            {
              "fixed": "5.5"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.7.11"
            },
            {
              "fixed": "5.8"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.8.0"
            },
            {
              "fixed": "6.12.111"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.53"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93798.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix reloc root cleanup in merge_reloc_roots()\n\nIf the root we got has zero root refs in its root item, we are resetting\nthe root's -\u003ereloc_root without using barriers like we do everywhere else.\nSashiko complained about this while reviewing another patch, and it's\ncorrect (see the Link tag below).\n\nAlso, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless\nthe root points to the reloc root we have.\n\nFix this by using clear_reloc_root(), which issues the memory barrier\nafter setting the root's -\u003ereloc_root to NULL and before clearing the bit\nBTRFS_ROOT_DEAD_RELOC_TREE from the root.",
  "id": "CVE-2026-93798",
  "modified": "2026-09-27T03:30:31.090078713Z",
  "published": "2026-09-24T16:02:31.291Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/63d6b1f04cd91c825329712aa526215ffa5d11ca"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ab48583aa9948205ff9a6470e23dbff74c565e24"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93798.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93798"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "btrfs: fix reloc root cleanup in merge_reloc_roots()"
}