UBUNTU-CVE-2026-89645: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails, btrfsrecoverrelocation() jumps to outunset before mergerelocroots() and cleandirtysubvols(). putreloccontrol() drops the list-owned relocation root references, but it does not clear fsroot->relocroot or drop the references owned by those pointers. Mount cleanup only drops them when BTRFSFSERROR is set, so an error such as -ENOMEM while processing a later root can leave references behind. Keep temporary references to the fs roots associated during recovery. On failure, clear their relocroot pointers and drop the corresponding references. Once the first transaction commit succeeds, drop only the temporary fs root references and let the normal merge and cleanup paths handle the relocation roots. Fault injection on a pending-relocation image confirmed the cleanup gap. With an injected first-commit failure, 25 fs roots had relocroot set with fserror=0. With this fix, the same failure path drops that count to 0 before mount fails.