Riskcovery

CVE-2026-98962

btrfs: free iov when btrfs_uring_read_extent() fails

State
Published
Severity
Not scored
Published
Oct 23, 2026
Updated
Oct 23, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: free iov when btrfs_uring_read_extent() fails

After btrfs_uring_read_extent(), the caller always jumped to out_acct. That skips kfree(data->iov), which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure, fall through to out_free instead.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 34310c442e175f286b4c06ab5caa4e0b267ea31c to before 7a3addbdc5ad1fd80541a6a4ff4e06cd1331530aAffected
  • 34310c442e175f286b4c06ab5caa4e0b267ea31c to before 578ef517142420cf9d36b364ad4b3490b85469fbAffected
  • 34310c442e175f286b4c06ab5caa4e0b267ea31c to before a8ea92830b3e0e163d4e829bdcb17ca83c0f951cAffected
LinuxLinux
  • 6.13Affected
  • before 6.13Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.2.11 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.