---
id: "CVE-2026-98962"
kind: "vulnerability"
aliases: ["CVE-2026-98962"]
title: "Linux kernel btrfs: failed io_uring read leaks an iov buffer"
severity: "unknown"
cvss: null
epss: 0.00206
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["btrfs", "infrastructure", "io_uring", "linux"]
not_affected_if: ["no-btrfs", "no-io_uring"]
published_at: "2026-10-23T13:17:17+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98962", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98962", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel btrfs: failed io_uring read leaks an iov buffer

When a btrfs read issued through io_uring fails, the kernel skips freeing the iov buffer it allocated, leaking kernel memory on each failed read. The description does not say an attacker can trigger or exploit the leak beyond exhausting memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel versions listed in the upstream CVE record (unknown from the sources given)
- Check whether btrfs is in use with `findmnt -t btrfs`

## Fix

- Update the Linux kernel to a release that contains the upstream fix for CVE-2026-98962 (exact version unknown from the sources)

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98962
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98962

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

btrfs: free iov when btrfs_uring_read_extent() fails

After btrfs_uring_read_extent(), the caller always jumped to out_acct.
That skips kfree(data->iov), which is only correct for -EIOCBQUEUED
where the deferred path owns the iov. On failure, fall through to
out_free instead.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_