Live › vulnerability › CVE-2026-98963
Go to dashboardA btrfs encoded read path in the Linux kernel could return an error after all I/O had already finished, so cleanup ran twice. The sources do not state a confirmed attacker outcome.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with btrfs and io_uring encoded reads. The sources do not say which kernel versions are affected or whether this is reachable by unprivileged users.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
If all bios finish before btrfs_encoded_read_regular_fill_pages() returns, it calls btrfs_uring_read_extent_endio() and previously returned the I/O status. A negative errno then made btrfs_uring_read_extent() unlock and free while btrfs_uring_read_finished() did the same again.
Return -EIOCBQUEUED so only the deferred path cleans up.
This page as .md · .json · in your agent: get_signal("CVE-2026-98963")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.