Live › vulnerability › CVE-2026-98962
Go to dashboardWhen a btrfs read issued through io_uring fails, the kernel skips freeing the iov buffer it allocated, leaking kernel memory on each failed read. The description does not say an attacker can trigger or exploit the leak beyond exhausting memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with btrfs filesystems that issue reads through io_uring. The sources do not say which kernel versions are affected or how commonly io_uring reads hit the failure path. Systems without btrfs or without io_uring use can likely skip it.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel versions listed in the upstream CVE record (unknown from the sources given)findmnt -t btrfsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
btrfs: free iov when btrfs_uring_read_extent() fails
After btrfs_uring_read_extent(), the caller always jumped to out_acct. That skips kfree(data->iov), which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure, fall through to out_free instead.
This page as .md · .json · in your agent: get_signal("CVE-2026-98962")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.