Reference Leak in Linux Kernel's Btrfs Scrub Functionality

CVE-2026-99067

What is CVE-2026-99067?

A vulnerability has been identified in the Linux kernel's btrfs scrub functionality, specifically concerning the management of reference counts. The issue arises when the function scrub_print_warning_inode() fails during path resolution and erroneously retains a root reference obtained via btrfs_get_fs_root(). This oversight results in a reference leak that occurs each time path resolution fails, potentially leading to resource mismanagement. A comprehensive fix has been implemented to ensure that the reference is properly released even in failure scenarios, thus enhancing stability and resource management. Users are encouraged to apply the latest patches to mitigate any risks associated with this vulnerability.

References