CVE-2026-99067 btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99067?
CVE-2026-99067 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
When paths_from_inode() fails, scrub_print_warning_inode() jumps to err without dropping the reference taken by btrfs_get_fs_root(), leaking a reference to the root every time path resolution fails while printing scrub warnings. Every other error and success path of the function drops the reference.
Drop the reference on the paths_from_inode() failure path too.
Which versions are affected by CVE-2026-99067?
How do I fix CVE-2026-99067?
Upgrade to a fixed version.
Is CVE-2026-99067 being exploited?
There is no known exploitation of CVE-2026-99067 in the wild and no public exploit code.
Sources
Also known as AZL-110957, BELL-CVE-2026-99067, DEBIAN-CVE-2026-99067, GHSA-hhhw-f92w-5h8m, UBUNTU-CVE-2026-99067.