CVE-2026-98960: btrfs: don't stash io_uring encoded data across -EAGAIN

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

btrfs: don't stash iouring encoded data across -EAGAIN

Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU allocations on cleanup.

Write: ioqueuesqe() always issues with IOURINGFNONBLOCK first, so return -EAGAIN before allocating and free data on every exit.

Read: free on nowait -EAGAIN too; only -EIOCBQUEUED keeps the allocation for btrfsuringreadfinished().

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 23, 2026

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

Description

Frequently Asked Questions

Which workloads are exposed to this issue?

The issue affects btrfs read and write paths that use io_uring encoded data. The leak scenario involves requests that encounter -EAGAIN.

What conditions are needed for the memory leak to occur?

For writes, an io_uring request must return -EAGAIN while encoded-data state remains attached to the command PDU, followed by request cancellation or ring exit before reissue. For reads, the relevant case is a nowait -EAGAIN; allocations are intended to remain only when the operation returns -EIOCBQUEUED for completion handling.

CVE-2026-98960: btrfs: don't stash io_uring encoded data across -EAGAIN

Affected Software

Event History

Frequently Asked Questions

Which workloads are exposed to this issue?

What conditions are needed for the memory leak to occur?

Company

Resources

Contact

Frequently Asked Questions

Which workloads are exposed to this issue?

What conditions are needed for the memory leak to occur?