{"id":"CVE-2026-98960","kind":"vulnerability","aliases":["CVE-2026-98960"],"related":[],"title":"Linux kernel btrfs: io_uring encoded data leaks on retry, exhausting memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't stash io_uring encoded data across -EAGAIN\n\nReturning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU\nleaks if the request is cancelled or the ring exits before reissue.\nio_uring does not free driver PDU allocations on cleanup.\n\nWrite: io_queue_sqe() always issues with IO_URING_F_NONBLOCK first, so\nreturn -EAGAIN before allocating and free data on every exit.\n\nRead: free on nowait -EAGAIN too; only -EIOCBQUEUED keeps the allocation\nfor btrfs_uring_read_finished().","summary":"In the Linux kernel's btrfs filesystem, io_uring encoded read and write requests keep an allocation alive when they return -EAGAIN, so the memory leaks if the request is cancelled or the ring exits before it is reissued. The sources describe a memory leak and do not state an attacker-controlled impact.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["btrfs","io-uring","linux-kernel","runtime","self-hosted"],"not_affected_if":["io-uring-disabled","no-btrfs"],"how_to_check":"- Run `uname -r` and compare the kernel version against the fixed release listed in the NVD entry\n- Check whether btrfs is in use with `findmnt -t btrfs`\n- Check whether io_uring is enabled with `sysctl kernel.io_uring_disabled`","fix":"- Update the Linux kernel to a release that includes the btrfs fix for CVE-2026-98960; the fixed version is unknown from the sources\n- Reboot into the patched kernel after the update","status":"open","published_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:46+00:00","updated_at":"2026-10-25T04:57:46+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T04:57:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the btrfs fix for CVE-2026-98960; the fixed version is unknown from the sources\n- Reboot into the patched kernel after the update","reach":"local","title":"Linux kernel btrfs: io_uring encoded data leaks on retry, exhausting memory","impact":"low","summary":"In the Linux kernel's btrfs filesystem, io_uring encoded read and write requests keep an allocation alive when they return -EAGAIN, so the memory leaks if the request is cancelled or the ring exits before it is reissued. The sources describe a memory leak and do not state an attacker-controlled impact.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","btrfs","io-uring","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Kernel memory leaks, degrading availability on affected btrfs systems","analyst_note":"Find the affected and fixed kernel versions and the upstream commit in the NVD entry or the kernel stable mailing list.","how_to_check":"- Run `uname -r` and compare the kernel version against the fixed release listed in the NVD entry\n- Check whether btrfs is in use with `findmnt -t btrfs`\n- Check whether io_uring is enabled with `sysctl kernel.io_uring_disabled`","needs_analyst":true,"not_affected_if":["no-btrfs","io-uring-disabled"],"who_is_affected":"Systems running a Linux kernel with btrfs filesystems and io_uring encoded read or write operations are the ones to look at. The sources do not say which kernel versions are affected or how often the leak is reachable in practice, so the exposure window is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000663,"input_tokens":3450,"output_tokens":636,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98960':15A,18A 'across':102C 'aliv':47B 'alloc':46B,135C,154C,171C 'alway':142C 'attack':81B 'attacker-control':80B 'btrfs':3A,19B,35B,94C,108C,173C 'cancel':60B,121C 'cleanup':137C 'cmd':114C 'control':82B 'cve':13A,16A 'data':7A,101C,111C,157C 'describ':71B 'driver':133C 'eagain':51B,103C,105C,152C,165C 'eiocbqueu':168C 'encod':6A,39B,100C,110C 'everi':159C 'exhaust':11A 'exit':64B,125C,160C 'f':147C 'filesystem':36B 'finish':176C 'first':149C 'follow':89C 'free':132C,156C,162C 'host':29B 'impact':83B 'io':4A,21B,37B,98C,128C,139C,145C 'io-ur':20B 'issu':143C 'keep':44B,169C 'kernel':2A,25B,33B,87C 'leak':8A,55B,74B,116C 'leav':107C 'linux':1A,24B,32B,86C 'linux-kernel':23B 'memori':12A,54B,73B 'nonblock':148C 'nowait':164C 'pdu':115C,134C 'queue':140C 'read':40B,161C,175C 'reissu':68B,127C 'request':43B,58B,119C 'resolv':93C 'retri':10A 'return':50B,104C,151C 'ring':63B,124C 'runtim':26B 'self':28B 'self-host':27B 'sourc':70B 'sqe':141C 'stash':97C 'state':78B 'ure':5A,22B,38B,99C,109C,129C,146C,174C 'vulner':90C 'write':42B,138C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with btrfs filesystems and io_uring encoded read or write operations are the ones to look at. The sources do not say which kernel versions are affected or how often the leak is reachable in practice, so the exposure window is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98960","severity":null,"published_at":"2026-10-23T13:17:17+00:00","modified_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}