All vulnerabilities
CVE-2026-98962

Linux: btrfs: free iov when btrfs_uring_read_extent() fails

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in7a3addbdc5ad1fd80541a6a4ff4e06cd1331530aAlso 578ef517142420cf9d36b364ad4b3490b85469fbCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 7a3addbdc5ad1fd80541a6a4ff4e06cd1331530aLinuxCVE List
  • 578ef517142420cf9d36b364ad4b3490b85469fbLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: free iov when btrfs_uring_read_extent() fails

After btrfs_uring_read_extent(), the caller always jumped to out_acct. That skips kfree(data->iov), which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure, fall through to out_free instead.

Text from CVE List

Affected versions 8

  • Linuxaffected: 34310c442e175f286b4c06ab5caa4e0b267ea31c before 7a3addbdc5ad1fd80541a6a4ff4e06cd1331530aCVE List
  • Linuxaffected: 34310c442e175f286b4c06ab5caa4e0b267ea31c before 578ef517142420cf9d36b364ad4b3490b85469fbCVE List
  • Linuxaffected: 34310c442e175f286b4c06ab5caa4e0b267ea31c before a8ea92830b3e0e163d4e829bdcb17ca83c0f951cCVE List
  • Linuxaffected: 6.13CVE List
  • Linuxunaffected: all versions before 6.13CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3