The vulnerability in the Linux kernel's Btrfs filesystem relates to the handling of relocation root references during relocation recovery. When recovery fails at certain points, such as loading or adding a later root or committing the first transaction, the function btrfs_recover_relocation() exits early without clearing all relocation root references. While put_reloc_control() drops list-owned references, it does not clear fs_root->reloc_root pointers or drop references owned by those pointers. Mount cleanup only clears these references if BTRFS_FS_ERROR is set, which may not happen on errors like -ENOMEM, leaving references behind. The fix involves keeping temporary references during recovery and ensuring that on failure, reloc_root pointers are cleared and references dropped before mount fails. Fault injection testing confirmed that the fix prevents leftover relocation root references after failure.

The vulnerability can cause resource leaks in the Btrfs filesystem during relocation recovery failures, potentially leading to inconsistent state or resource exhaustion. There is no indication of direct exploitation or security compromise beyond resource management issues. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by properly clearing relocation root references on recovery failure. Users should update to the fixed kernel version when available. Since this is a kernel-level fix, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly stated in the input; check the vendor advisory for the exact fixed versions and update accordingly.