All vulnerabilities
CVE-2026-98963

Linux: btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in033dda5b321f01661de518a8d5c8607ae8675b14Also 80a8dbb30d2b00b9c671b02bd73f700f6d20100fCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 033dda5b321f01661de518a8d5c8607ae8675b14LinuxCVE List
  • 80a8dbb30d2b00b9c671b02bd73f700f6d20100fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio

If all bios finish before btrfs_encoded_read_regular_fill_pages() returns, it calls btrfs_uring_read_extent_endio() and previously returned the I/O status. A negative errno then made btrfs_uring_read_extent() unlock and free while btrfs_uring_read_finished() did the same again.

Return -EIOCBQUEUED so only the deferred path cleans up.

Text from CVE List

Affected versions 8

  • Linuxaffected: 34310c442e175f286b4c06ab5caa4e0b267ea31c before 033dda5b321f01661de518a8d5c8607ae8675b14CVE List
  • Linuxaffected: 34310c442e175f286b4c06ab5caa4e0b267ea31c before a449433b0e3d4a3715d0bbee078f8c603f03c9f6CVE List
  • Linuxaffected: 34310c442e175f286b4c06ab5caa4e0b267ea31c before 80a8dbb30d2b00b9c671b02bd73f700f6d20100fCVE List
  • Linuxaffected: 6.13CVE List
  • Linuxunaffected: all versions before 6.13CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3