Live › vulnerability › CVE-2026-98961
Go to dashboardIn the btrfs filesystem, a failed io_uring encoded read could return without releasing the inode and extent locks, or skip unlocking on a pages-array allocation failure. The sources do not say what an attacker gains beyond a stalled or deadlocked file operation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
The sources describe a Linux kernel btrfs code path used by io_uring encoded reads, so systems mounting btrfs filesystems on a kernel without the fix are in scope. Systems without btrfs or without io_uring encoded reads are likely not affected, but the sources do not confirm this.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
btrfs: unlock inode and extent in caller when io_uring read extent fails
btrfs_uring_read_extent() runs only after btrfs_encoded_read() has taken the inode shared lock and the extent lock. On failure it used to unlock in out_fail, and a pages-array allocation failure returned -ENOMEM without unlocking at all.
Unlock in the caller instead on all failure returns, matching the copy_to_user() error path. The deferred -EIOCBQUEUED path still unlocks in btrfs_uring_read_finished().
This page as .md · .json · in your agent: get_signal("CVE-2026-98961")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.