Root certificates don't need to be revoked unless they are compromised. In case they are compromised they can be revoked by placing them on a blacklist within e.g. a browser, or by removing them altogether. Obviously it's not possible to just create a CRL as there would not be a trusted private key; instead this is a out-of-order operation.
In general it's better to create a new root certificate and let the old one expire. Note that the underlying certificates should have an expiration date that is lower or equal to the expiration date of their parent. Of course the new root certificates need to be communicated securely to e.g. the browser manufacturers. How this can be done is generally communicated by the browser manufacturers, e.g. see the Mozilla policy here.