{"id":"CVE-2026-98961","kind":"vulnerability","aliases":["CVE-2026-98961"],"related":[],"title":"Linux kernel btrfs: io_uring encoded read leaves inode and extent locked","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: unlock inode and extent in caller when io_uring read extent fails\n\nbtrfs_uring_read_extent() runs only after btrfs_encoded_read() has taken\nthe inode shared lock and the extent lock.  On failure it used to unlock\nin out_fail, and a pages-array allocation failure returned -ENOMEM\nwithout unlocking at all.\n\nUnlock in the caller instead on all failure returns, matching the\ncopy_to_user() error path.  The deferred -EIOCBQUEUED path still unlocks\nin btrfs_uring_read_finished().","summary":"In the btrfs filesystem, a failed io_uring encoded read could return without releasing the inode and extent locks, or skip unlocking on a pages-array allocation failure. The sources do not say what an attacker gains beyond a stalled or deadlocked file operation.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["btrfs","infrastructure","kernel","linux","self-hosted"],"not_affected_if":["no-btrfs"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream btrfs commit resolving this CVE; the sources do not name a version.","status":"open","published_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:43+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:57:43Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream btrfs commit resolving this CVE; the sources do not name a version.","reach":"local","title":"Linux kernel btrfs: io_uring encoded read leaves inode and extent locked","impact":"low","summary":"In the btrfs filesystem, a failed io_uring encoded read could return without releasing the inode and extent locks, or skip unlocking on a pages-array allocation failure. The sources do not say what an attacker gains beyond a stalled or deadlocked file operation.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","btrfs","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; a lock may be left held after a failed read","analyst_note":"Confirm the affected kernel version range and the fixed commit from the NVD entry and the upstream kernel git log; check whether the lock leak has a user-visible denial-of-service effect.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-btrfs"],"who_is_affected":"The sources describe a Linux kernel btrfs code path used by io_uring encoded reads, so systems mounting btrfs filesystems on a kernel without the fix are in scope. Systems without btrfs or without io_uring encoded reads are likely not affected, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000604,"input_tokens":3423,"output_tokens":523,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98961':15A,18A 'alloc':53B,128C 'array':52B,127C 'attack':62B 'beyond':64B 'btrfs':3A,19B,28B,81C,94C,101C,159C 'caller':87C,139C 'copi':147C 'could':36B 'cve':13A,16A 'deadlock':68B 'defer':153C 'eiocbqueu':154C 'encod':6A,34B,102C 'enomem':131C 'error':150C 'extent':11A,43B,85C,92C,97C,112C 'fail':31B,93C,122C 'failur':54B,115C,129C,143C 'file':69B 'filesystem':29B 'finish':162C 'follow':76C 'gain':63B 'host':25B 'infrastructur':20B 'inod':9A,41B,83C,107C 'instead':140C 'io':4A,32B,89C 'kernel':2A,21B,74C 'leav':8A 'linux':1A,22B,73C 'lock':12A,44B,109C,113C 'match':145C 'oper':70B 'page':51B,126C 'pages-array':50B,125C 'path':151C,155C 'read':7A,35B,91C,96C,103C,161C 'releas':39B 'resolv':80C 'return':37B,130C,144C 'run':98C 'say':59B 'self':24B 'self-host':23B 'share':108C 'skip':46B 'sourc':56B 'stall':66B 'still':156C 'taken':105C 'unlock':47B,82C,119C,133C,136C,157C 'ure':5A,33B,90C,95C,160C 'use':117C 'user':149C 'vulner':77C 'without':38B,132C","nicknames":[],"mitigations":[],"who_affected":"The sources describe a Linux kernel btrfs code path used by io_uring encoded reads, so systems mounting btrfs filesystems on a kernel without the fix are in scope. Systems without btrfs or without io_uring encoded reads are likely not affected, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98961","severity":null,"published_at":"2026-10-23T13:17:17+00:00","modified_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98961","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98961","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}