# CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create

Status: published. Published: 2026-04-22. Updated: 2026-11-05.

In the Linux kernel, the following vulnerability has been resolved:

btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create

We have recently observed a number of subvolumes with broken dentries.
ls-ing the parent dir looks like:

drwxrwxrwt 1 root root 16 Jan 23 16:49 .
drwxr-xr-x 1 root root 24 Jan 23 16:48 ..
d????????? ? ?    ?     ?            ? broken_subvol

and similarly stat-ing the file fails.

In this state, deleting the subvol fails with ENOENT, but attempting to
create a new file or subvol over it errors out with EEXIST and even
aborts the fs. Which leaves us a bit stuck.

dmesg contains a single notable error message reading:
"could not do orphan cleanup -2"

2 is ENOENT and the error comes from the failure handling path of
btrfs_orphan_cleanup(), with the stack leading back up to
btrfs_lookup().

btrfs_lookup
btrfs_lookup_dentry
btrfs_orphan_cleanup // prints that message and returns -ENOENT

After some detailed inspection of the internal state, it became clear
that:
- there are no orphan items for the subvol
- the subvol is otherwise healthy looking, it is not half-deleted or
  anything, there is no drop progress, etc.
- the subvol was created a while ago and does the meaningful first
  btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much
  later.
- after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT,
  which results in a negative dentry for the subvolume via
  d_splice_alias(NULL, dentry), leading to the observed behavior. The
  bug can be mitigated by dropping the dentry cache, at which point we
  can successfully delete the subvolume if we want.

i.e.,
btrfs_lookup()
  btrfs_lookup_dentry()
    if (!sb_rdonly(inode->vfs_inode)->vfs_inode)
    btrfs_orphan_cleanup(sub_root)
      test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)
      btrfs_search_slot() // finds orphan item for inode N
      ...
      prints "could not do orphan cleanup -2"
  if (inode == ERR_PTR(-ENOENT))
    inode = NULL;
  return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume

btrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)
on the root when it runs, so it cannot run more than once on a given
root, so something else must run concurrently. However, the obvious
routes to deleting an orphan when nlinks goes to 0 should not be able to
run without first doing a lookup into the subvolume, which should run
btrfs_orphan_cleanup() and set the bit.

The final important observation is that create_subvol() calls
d_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if
the dentry cache gets dropped, the next lookup into the subvolume will
make a real call into btrfs_orphan_cleanup() for the first time. This
opens up the possibility of concurrently deleting the inode/orphan items
but most typical evict() paths will be holding a reference on the parent
dentry (child dentry holds parent->d_lockref.count via dget in
d_alloc(), released in __dentry_kill()) and prevent the parent from
being removed from the dentry cache.

The one exception is delayed iputs. Ordered extent creation calls
igrab() on the inode. If the file is unlinked and closed while those
refs are held, iput() in __dentry_kill() decrements i_count but does
not trigger eviction (i_count > 0). The child dentry is freed and the
subvol dentry's d_lockref.count drops to 0, making it evictable while
the inode is still alive.

Since there are two races (the race between writeback and unlink and
the race between lookup and delayed iputs), and there are too many moving
parts, the following three diagrams show the complete picture.
(Only the second and third are races)

Phase 1:
Create Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set

btrfs_mksubvol()
  lookup_one_len()
    __lookup_slow()
      d_alloc_parallel()
        __d_alloc() // d_lockref.count = 1
  create_subvol(dentry)
    // doesn't touch the bit..
    d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.c
---truncated---

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ c71bf099abddf3e0fdc27f251ba76fca1461d49a; < d43da8de0ed376abafbad8a245a1835e8f66cb0f (affected, git); ≥ c71bf099abddf3e0fdc27f251ba76fca1461d49a; < c57276ced3c3207f42182dfa2f0d8e860357e111 (affected, git); ≥ c71bf099abddf3e0fdc27f251ba76fca1461d49a; < a41a9b8d19a98b45591528c6e54d31cc66271d1e (affected, git); ≥ c71bf099abddf3e0fdc27f251ba76fca1461d49a; < 2ec578e6452138ab76f6c9a9c18711fcd197649f (affected, git); ≥ c71bf099abddf3e0fdc27f251ba76fca1461d49a; < 696683f214495db3cdacab9a713efaaced8660f8 (affected, git); ≥ c71bf099abddf3e0fdc27f251ba76fca1461d49a; < 5131fa077f9bb386a1b901bf5b247041f0ec8f80 (affected, git); c4ba0bd9db5e8fd2664be0fd4ec01335fe3268eb (affected, git); ≥ 2.6.32.19; < 2.6.33 (affected, semver). Source: CNA: Linux
- Linux / Linux: 2.6.33 (affected); ≥ 0; < 2.6.33 (unaffected, semver); ≥ 6.1.168; ≤ 6.1.* (unaffected, semver); ≥ 6.6.131; ≤ 6.6.* (unaffected, semver); ≥ 6.12.80; ≤ 6.12.* (unaffected, semver); ≥ 6.18.21; ≤ 6.18.* (unaffected, semver); ≥ 6.19.11; ≤ 6.19.* (unaffected, semver); ≥ 7.0; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.12% as of 2026-11-05; percentile 2.04%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/d43da8de0ed376abafbad8a245a1835e8f66cb0f (CNA: Linux)

- https://git.kernel.org/stable/c/c57276ced3c3207f42182dfa2f0d8e860357e111 (CNA: Linux)

- https://git.kernel.org/stable/c/a41a9b8d19a98b45591528c6e54d31cc66271d1e (CNA: Linux)

- https://git.kernel.org/stable/c/2ec578e6452138ab76f6c9a9c18711fcd197649f (CNA: Linux)

- https://git.kernel.org/stable/c/696683f214495db3cdacab9a713efaaced8660f8 (CNA: Linux)

- https://git.kernel.org/stable/c/5131fa077f9bb386a1b901bf5b247041f0ec8f80 (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-31519; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-31519; retrieved 2026-11-05; source updated Not reported

Revision: bc60ae40da464bbb8094bb6792d68550b3afa0ca3025ac169faa65382758fb1c

Canonical: https://y2.dev/cve/CVE-2026-31519

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.