{
  "threat_severity" : "Low",
  "public_date" : "2026-08-12T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: btrfs: free mapping node on duplicate reloc root insert",
    "id" : "2514461",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2514461"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-772",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nbtrfs: free mapping node on duplicate reloc root insert\n__add_reloc_root() allocates a mapping_node before inserting it into\nrc->reloc_root_tree.  If rb_simple_insert() finds an existing entry, it\nreturns the existing rb_node and leaves the newly allocated node unlinked.\nThe error path then returns -EEXIST without freeing the new node.  Since\nthe node was never inserted into reloc_root_tree, the later cleanup in\nput_reloc_control() cannot find it either.\nFree the newly allocated node before returning -EEXIST.\nThe callers currently assert that -EEXIST should not happen, so this is a\ndefensive cleanup for an unexpected duplicate insert path.  If the path is\never reached, the local allocation should still be released.", "A flaw was found in the Linux kernel's btrfs filesystem. When the `__add_reloc_root()` function attempts to insert a duplicate mapping node into the `reloc_root_tree`, the newly allocated node is not properly freed. This oversight can lead to a memory leak, potentially causing resource exhaustion and a Denial of Service (DoS) over an extended period if this unexpected path is triggered." ],
  "statement" : "Red Hat has determined that this vulnerability does not pose a significant risk. The memory leak occurs on a defensive error path that upstream callers assert should never be reached, and triggering btrfs relocation requires administrative privileges. Red Hat may apply this fix in a future kernel update.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux for NVIDIA 26",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel",
    "cpe" : "cpe:/a:redhat:enterprise_linux_nvidia:"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "erlang27",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "rhcos",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-68450\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68450\nhttps://lore.kernel.org/linux-cve-announce/2026081225-CVE-2026-68450-e589@gregkh/T" ],
  "name" : "CVE-2026-68450",
  "mitigation" : {
    "value" : "There is no mitigation for this flaw. Systems not using btrfs filesystems are not affected in practice, as the vulnerable code path is only reached during btrfs block group relocation operations.",
    "lang" : "en:us"
  },
  "csaw" : false
}