Live › vulnerability › CVE-2026-98960
Go to dashboardIn the Linux kernel's btrfs filesystem, io_uring encoded read and write requests keep an allocation alive when they return -EAGAIN, so the memory leaks if the request is cancelled or the ring exits before it is reissued. The sources describe a memory leak and do not state an attacker-controlled impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with btrfs filesystems and io_uring encoded read or write operations are the ones to look at. The sources do not say which kernel versions are affected or how often the leak is reachable in practice, so the exposure window is unknown.
No product ranges from the sources yet.
uname -r and compare the kernel version against the fixed release listed in the NVD entryfindmnt -t btrfssysctl kernel.io_uring_disabledEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't stash io_uring encoded data across -EAGAIN
Returning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io_uring does not free driver PDU allocations on cleanup.
Write: io_queue_sqe() always issues with IO_URING_F_NONBLOCK first, so return -EAGAIN before allocating and free data on every exit.
Read: free on nowait -EAGAIN too; only -EIOCBQUEUED keeps the allocation for btrfs_uring_read_finished().
This page as .md · .json · in your agent: get_signal("CVE-2026-98960")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.