CVE-2026-98962

The Linux kernel contains a vulnerability within the btrfs file system. Specifically, after the btrfs_uring_read_extent() function is called, the code incorrectly jumped to out_acct, causing it to skip the kfree(data->iov) operation. This memory deallocation is only appropriate for the -EIOCBQ...

EUVD-2026-108756

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfsuringreadextent fails After btrfsuringreadextent, the caller always jumped to outacct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure,...

CVE-2026-98961

The Linux kernel contains a vulnerability in the btrfs filesystem related to how locks are handled during io_uring operations. Specifically, in the btrfs_uring_read_extent() function, the system takes an inode shared lock and an extent lock . Previously, a pages-array allocation failure would ret...

EUVD-2026-108755

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent runs only after btrfsencodedread has taken the inode shared lock and the extent lock. On failure it used to unlock in outfail, and a...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: btrfs: The free pages operation fails with an error in btrfsuringreadextent. In this function, the pages object is never freed, with the hope that it will be picked up by btrfsuringreadfinished whenever that function is executed ...

CVE-2026-23423

CVE-2026-23423 concerns memory management in the Linux kernel’s btrfs_uring_read_extent() path. The issue: the 'pages' object allocated during read operations is not freed in error scenarios, under the hopeful path that it will be reclaimed by btrfs_uring_read_finished() later. If errors occur (e...

CVE-2026-23423 btrfs: free pages on error in btrfs_uring_read_extent()

In the Linux kernel, the following vulnerability has been resolved: btrfs: free pages on error in btrfsuringreadextent In this function the 'pages' object is never freed in the hopes that it is picked up by btrfsuringreadfinished whenever that executes in the future. But that's just the happy pat...

CVE-2026-23423: Missing Release of Memory after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: btrfs: free pages on error in btrfsuringreadextent In this function the 'pages' object is never freed in the hopes that it is picked up by btrfsuringreadfinished whenever that executes in the future. But that's just the happy pat...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from an error in the path of the btrfsuringreadextent function; pages are not reclaimed after executio...