All vulnerabilities
CVE-2026-98961

Linux: btrfs: unlock inode and extent in caller when io_uring read extent fails

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 24 Oct 2026FIRST EPSS
Fixed in2797eb38773a96914ccedeec71eb2144645400b2Fixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 2797eb38773a96914ccedeec71eb2144645400b2LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: unlock inode and extent in caller when io_uring read extent fails

btrfs_uring_read_extent() runs only after btrfs_encoded_read() has taken the inode shared lock and the extent lock. On failure it used to unlock in out_fail, and a pages-array allocation failure returned -ENOMEM without unlocking at all.

Unlock in the caller instead on all failure returns, matching the copy_to_user() error path. The deferred -EIOCBQUEUED path still unlocks in btrfs_uring_read_finished().

Text from CVE List

Affected versions 8

  • Linuxaffected: 34310c442e175f286b4c06ab5caa4e0b267ea31c before 2797eb38773a96914ccedeec71eb2144645400b2CVE List
  • Linuxaffected: 34310c442e175f286b4c06ab5caa4e0b267ea31c before ada1fc725a4db407294ae90a0d40ef1c46f457f2CVE List
  • Linuxaffected: 34310c442e175f286b4c06ab5caa4e0b267ea31c before b6e8add5d79d1f6f819a054c833bab452bd7365dCVE List
  • Linuxaffected: 6.13CVE List
  • Linuxunaffected: all versions before 6.13CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3