{"id":"CVE-2026-98963","kind":"vulnerability","aliases":["CVE-2026-98963"],"related":[],"title":"Linux kernel btrfs: double unlock and free on failed encoded read","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio\n\nIf all bios finish before btrfs_encoded_read_regular_fill_pages()\nreturns, it calls btrfs_uring_read_extent_endio() and previously\nreturned the I/O status.  A negative errno then made\nbtrfs_uring_read_extent() unlock and free while\nbtrfs_uring_read_finished() did the same again.\n\nReturn -EIOCBQUEUED so only the deferred path cleans up.","summary":"A btrfs encoded read path in the Linux kernel could return an error after all I/O had already finished, so cleanup ran twice. The sources do not state a confirmed attacker outcome.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["btrfs","infrastructure","kernel","linux"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:42+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:57:42Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel btrfs: double unlock and free on failed encoded read","impact":"medium","summary":"A btrfs encoded read path in the Linux kernel could return an error after all I/O had already finished, so cleanup ran twice. The sources do not state a confirmed attacker outcome.","category":"infrastructure","nicknames":[],"who_cares":["linux","btrfs","kernel"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, fixed stable versions, and whether a local user can trigger it.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with btrfs and io_uring encoded reads. The sources do not say which kernel versions are affected or whether this is reachable by unprivileged users.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000529,"input_tokens":3407,"output_tokens":377,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98963':14A,17A 'alreadi':39B 'alway':65C 'attack':52B 'bio':76C 'btrfs':3A,18B,23B,64C,69C,79C,88C,104C,112C 'call':87C 'clean':127C 'cleanup':42B 'confirm':51B 'could':31B 'cve':12A,15A 'defer':125C 'doubl':4A 'eiocbqueu':67C,121C 'encod':10A,24B,80C 'endio':73C,92C 'errno':101C 'error':34B 'extent':72C,91C,107C 'fail':9A 'fill':83C 'finish':40B,77C,115C 'follow':59C 'free':7A,110C 'i/o':37B,97C 'infrastructur':19B 'kernel':2A,20B,30B,57C 'linux':1A,21B,29B,56C 'made':103C 'negat':100C 'outcom':53B 'page':84C 'path':26B,126C 'previous':94C 'ran':43B 'read':11A,25B,71C,81C,90C,106C,114C 'regular':82C 'resolv':63C 'return':32B,66C,85C,95C,120C 'sourc':46B 'state':49B 'status':98C 'twice':44B 'unlock':5A,108C 'ure':70C,89C,105C,113C 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with btrfs and io_uring encoded reads. The sources do not say which kernel versions are affected or whether this is reachable by unprivileged users.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98963","severity":null,"published_at":"2026-10-23T13:17:17+00:00","modified_at":"2026-10-23T13:17:17+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98963","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98963","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}