CVE-2023-53618: btrfs: reject invalid reloc tree root keys with stack dump

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-07 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: reject invalid reloc tree root keys with stack dump [BUG] Syzbot reported a crash that an ASSERT() got triggered inside prepare_to_merge(). That ASSERT() makes sure the reloc tree is properly pointed back by its subvolume tree. [CAUSE] After more debugging output, it turns out we had an invalid reloc tree: BTRFS error (device loop1): reloc tree mismatch, root 8 has no reloc root, expect reloc root key (-8, 132, 8) gen 17 Note the above root key is (TREE_RELOC_OBJECTID, ROOT_ITEM, QUOTA_TREE_OBJECTID), meaning it's a reloc tree for quota tree. But reloc trees can only exist for subvolumes, as for non-subvolume trees, we just COW the involved tree block, no need to create a reloc tree since those tree blocks won't be shared with other trees. Only subvolumes tree can share tree blocks with other trees (thus they have BTRFS_ROOT_SHAREABLE flag). Thus this new debug output proves my previous assumption that corrupted on-disk data can trigger that ASSERT(). [FIX] Besides the dedicated fix and the graceful exit, also let tree-checker to check such root keys, to make sure reloc trees can only exist for subvolumes.

Affected products

Linux kernel: from 5.2.19 before 5.3; from 5.3.4 before 5.15.127; from 5.16 before 6.1.46; from 6.2 before 6.4.11; 6.5-rc1, 6.5-rc2, 6.5-rc3, 6.5-rc4, 6.5-rc5 — fixed in 5.15.127, 5.3, 6.1.46, 6.4.11

How to fix

Upgrade to a fixed version: Linux kernel 5.15.127, 5.3, 6.1.46, 6.4.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-53618 or the next vulnerability affects your stack