CVE-2026-99067

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99067", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.389Z", "datePublished": "2026-10-23T12:23:10.430Z", "dateUpdated": "2026-10-30T12:41:28.799Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:28.799Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n\nWhen paths_from_inode() fails, scrub_print_warning_inode() jumps to err\nwithout dropping the reference taken by btrfs_get_fs_root(), leaking a\nreference to the root every time path resolution fails while printing\nscrub warnings. Every other error and success path of the function\ndrops the reference.\n\nDrop the reference on the paths_from_inode() failure path too."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/scrub.c"], "versions": [{"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "lessThan": "caebda739a724f0db57753351c01eaf2bf610576", "status": "affected", "versionType": "git"}, {"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "lessThan": "fc6d6b17584de7fb616b011e01f008ec3328063f", "status": "affected", "versionType": "git"}, {"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "lessThan": "e8d5cdd2b2e88177334326b002a58a5fae6e380c", "status": "affected", "versionType": "git"}, {"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "lessThan": "41cabfbf3532e2a2a17be9e4876042a5393b5c8d", "status": "affected", "versionType": "git"}, {"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "lessThan": "452a435b74f7f598a343c51f7c89c5d2244384b6", "status": "affected", "versionType": "git"}, {"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "lessThan": "12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549", "status": "affected", "versionType": "git"}, {"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "lessThan": "a7e5992bc37088f9b00e531955022aef69de3dc7", "status": "affected", "versionType": "git"}, {"version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "lessThan": "1fd742c7479961da6d0bb794ef8ac6b7b9442847", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/scrub.c"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/caebda739a724f0db57753351c01eaf2bf610576"}, {"url": "https://git.kernel.org/stable/c/fc6d6b17584de7fb616b011e01f008ec3328063f"}, {"url": "https://git.kernel.org/stable/c/e8d5cdd2b2e88177334326b002a58a5fae6e380c"}, {"url": "https://git.kernel.org/stable/c/41cabfbf3532e2a2a17be9e4876042a5393b5c8d"}, {"url": "https://git.kernel.org/stable/c/452a435b74f7f598a343c51f7c89c5d2244384b6"}, {"url": "https://git.kernel.org/stable/c/12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549"}, {"url": "https://git.kernel.org/stable/c/a7e5992bc37088f9b00e531955022aef69de3dc7"}, {"url": "https://git.kernel.org/stable/c/1fd742c7479961da6d0bb794ef8ac6b7b9442847"}], "title": "btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/btrfs/scrub.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "caebda739a724f0db57753351c01eaf2bf610576", "status": "affected", "version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "versionType": "git"}, {"lessThan": "fc6d6b17584de7fb616b011e01f008ec3328063f", "status": "affected", "version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "versionType": "git"}, {"lessThan": "e8d5cdd2b2e88177334326b002a58a5fae6e380c", "status": "affected", "version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "versionType": "git"}, {"lessThan": "41cabfbf3532e2a2a17be9e4876042a5393b5c8d", "status": "affected", "version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "versionType": "git"}, {"lessThan": "452a435b74f7f598a343c51f7c89c5d2244384b6", "status": "affected", "version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "versionType": "git"}, {"lessThan": "12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549", "status": "affected", "version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "versionType": "git"}, {"lessThan": "a7e5992bc37088f9b00e531955022aef69de3dc7", "status": "affected", "version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "versionType": "git"}, {"lessThan": "1fd742c7479961da6d0bb794ef8ac6b7b9442847", "status": "affected", "version": "558540c17771eaf89b1a3be39aa2c8bc837da1a6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/btrfs/scrub.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"lessThan": "3.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n\nWhen paths_from_inode() fails, scrub_print_warning_inode() jumps to err\nwithout dropping the reference taken by btrfs_get_fs_root(), leaking a\nreference to the root every time path resolution fails while printing\nscrub warnings. Every other error and success path of the function\ndrops the reference.\n\nDrop the reference on the paths_from_inode() failure path too."}], "id": "CVE-2026-99067", "lastModified": "2026-10-30T13:21:43.170", "metrics": {}, "published": "2026-10-23T13:17:30.583", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1fd742c7479961da6d0bb794ef8ac6b7b9442847"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41cabfbf3532e2a2a17be9e4876042a5393b5c8d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/452a435b74f7f598a343c51f7c89c5d2244384b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a7e5992bc37088f9b00e531955022aef69de3dc7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/caebda739a724f0db57753351c01eaf2bf610576"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e8d5cdd2b2e88177334326b002a58a5fae6e380c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fc6d6b17584de7fb616b011e01f008ec3328063f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()", "id": "2559780", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559780"}, "csaw": false, "cvss3": {"cvss3_base_score": "1.9", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's Btrfs file system. When path resolution encounters an error while reporting scrub warnings, the kernel fails to release an acquired reference to the file system root structure. A local user could trigger this condition during file system scrubbing to cause a resource leak, potentially leading to resource exhaustion or a Denial of Service (DoS)."], "name": "CVE-2026-99067", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99067\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99067\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99067.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[558540c17771eaf89b1a3be39aa2c8bc837da1a6,41cabfbf3532e2a2a17be9e4876042a5393b5c8d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[558540c17771eaf89b1a3be39aa2c8bc837da1a6,452a435b74f7f598a343c51f7c89c5d2244384b6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[558540c17771eaf89b1a3be39aa2c8bc837da1a6,12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[558540c17771eaf89b1a3be39aa2c8bc837da1a6,a7e5992bc37088f9b00e531955022aef69de3dc7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[558540c17771eaf89b1a3be39aa2c8bc837da1a6,1fd742c7479961da6d0bb794ef8ac6b7b9442847)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[558540c17771eaf89b1a3be39aa2c8bc837da1a6,41cabfbf3532e2a2a17be9e4876042a5393b5c8d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[558540c17771eaf89b1a3be39aa2c8bc837da1a6,452a435b74f7f598a343c51f7c89c5d2244384b6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[558540c17771eaf89b1a3be39aa2c8bc837da1a6,12ba7d8b9cd45a2c6aa8f37c3f4b8a50422fb549)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[558540c17771eaf89b1a3be39aa2c8bc837da1a6,a7e5992bc37088f9b00e531955022aef69de3dc7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[558540c17771eaf89b1a3be39aa2c8bc837da1a6,1fd742c7479961da6d0bb794ef8ac6b7b9442847)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:45:16.728478+00:00", "updated": "2026-10-27T18:30:08.204709+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}