{"id":"CVE-2026-98962","kind":"vulnerability","aliases":["CVE-2026-98962"],"related":[],"title":"Linux kernel btrfs: failed io_uring read leaks an iov buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free iov when btrfs_uring_read_extent() fails\n\nAfter btrfs_uring_read_extent(), the caller always jumped to out_acct.\nThat skips kfree(data->iov), which is only correct for -EIOCBQUEUED\nwhere the deferred path owns the iov. On failure, fall through to\nout_free instead.","summary":"When a btrfs read issued through io_uring fails, the kernel skips freeing the iov buffer it allocated, leaking kernel memory on each failed read. The description does not say an attacker can trigger or exploit the leak beyond exhausting memory.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["btrfs","infrastructure","io_uring","linux"],"not_affected_if":["no-btrfs","no-io_uring"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed in the upstream CVE record (unknown from the sources given)\n- Check whether btrfs is in use with `findmnt -t btrfs`","fix":"- Update the Linux kernel to a release that contains the upstream fix for CVE-2026-98962 (exact version unknown from the sources)","status":"open","published_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:43+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:57:43Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that contains the upstream fix for CVE-2026-98962 (exact version unknown from the sources)","reach":"local","title":"Linux kernel btrfs: failed io_uring read leaks an iov buffer","impact":"low","summary":"When a btrfs read issued through io_uring fails, the kernel skips freeing the iov buffer it allocated, leaking kernel memory on each failed read. The description does not say an attacker can trigger or exploit the leak beyond exhausting memory.","category":"infrastructure","nicknames":[],"who_cares":["linux","btrfs","io_uring"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory leaks on failed btrfs io_uring reads","analyst_note":"Confirm affected kernel version ranges and the fixed commit from the NVD record or kernel.org stable mailing list.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed in the upstream CVE record (unknown from the sources given)\n- Check whether btrfs is in use with `findmnt -t btrfs`","needs_analyst":true,"not_affected_if":["no-btrfs","no-io_uring"],"who_is_affected":"Systems running a Linux kernel with btrfs filesystems that issue reads through io_uring. The sources do not say which kernel versions are affected or how commonly io_uring reads hit the failure path. Systems without btrfs or without io_uring use can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000614,"input_tokens":3351,"output_tokens":557,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98962':14A,17A 'acct':94C 'alloc':40B 'alway':90C 'attack':54B 'beyond':61B 'btrfs':3A,18B,25B,74C,78C,84C 'buffer':11A,38B 'caller':89C 'correct':103C 'cve':12A,15A 'data':98C 'defer':108C 'descript':49B 'eiocbqueu':105C 'exhaust':62B 'exploit':58B 'extent':81C,87C 'fail':4A,31B,46B,82C 'failur':114C 'fall':115C 'follow':69C 'free':35B,75C,119C 'infrastructur':19B 'instead':120C 'io':5A,20B,29B 'iov':10A,37B,76C,99C,112C 'issu':27B 'jump':91C 'kernel':2A,33B,42B,67C 'kfree':97C 'leak':8A,41B,60B 'linux':1A,22B,66C 'memori':43B,63B 'own':110C 'path':109C 'read':7A,26B,47B,80C,86C 'resolv':73C 'say':52B 'skip':34B,96C 'trigger':56B 'ure':6A,21B,30B,79C,85C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with btrfs filesystems that issue reads through io_uring. The sources do not say which kernel versions are affected or how commonly io_uring reads hit the failure path. Systems without btrfs or without io_uring use can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98962","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98962","severity":null,"published_at":"2026-10-23T13:17:17+00:00","modified_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98962","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98962","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}