CVE-2026-98961
btrfs: unlock inode and extent in caller when io_uring read extent fails
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
0.2%
Percentile 10.1%
as of 2026-10-24
CISA KEV
—
Not listed
Description
NVD
In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when io_uring read extent fails btrfs_uring_read_extent() runs only after btrfs_encoded_read() has taken the inode shared lock and the extent lock. On failure it used to unlock in out_fail, and a pages-array allocation failure returned -ENOMEM without unlocking at all. Unlock in the caller instead on all failure returns, matching the copy_to_user() error path. The deferred -EIOCBQUEUED path still unlocks in btrfs_uring_read_finished().
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | affected: 34310c442e175f286b4c06ab5caa4e0b267ea31c … < 2797eb38773a96914ccedeec71eb2144645400b2 affected: 34310c442e175f286b4c06ab5caa4e0b267ea31c … < ada1fc725a4db407294ae90a0d40ef1c46f457f2 affected: 34310c442e175f286b4c06ab5caa4e0b267ea31c … < b6e8add5d79d1f6f819a054c833bab452bd7365d default: unaffected |
| Linux | Linux | affected: 6.13 unaffected: 0 … < 6.13 unaffected: 6.18.57 … <= 6.18.* unaffected: 7.2.11 … <= 7.2.* unaffected: 7.3 … <= * default: affected |
Open-source packages (GitHub Advisory / OSV)
CVE-2026-98961
OSV
btrfs: unlock inode and extent in caller when io_uring read extent fails
| Ecosystem | Package | Affected versions | Fixed in |
|---|---|---|---|
| >= 34310c442e175f286b4c06ab5caa4e0b267ea31c, < 2797eb38773a96914ccedeec71eb2144645400b2; < ada1fc725a4db407294ae90a0d40ef1c46f457f2; < b6e8add5d79d1f6f819a054c833bab452bd7365d | 2797eb38773a96914ccedeec71eb2144645400b2, ada1fc725a4db407294ae90a0d40ef1c46f457f2, b6e8add5d79d1f6f819a054c833bab452bd7365d | ||
| Linux | Kernel | >= 6.13.0, < 6.18.57; >= 6.19.0, < 7.2.11 | 6.18.57, 7.2.11 |
Linux distribution status
References (6)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git OSV
- https://git.kernel.org/stable/c/2797eb38773a96914ccedeec71eb2144645400b2 NVD, CNA, OSV
- https://git.kernel.org/stable/c/ada1fc725a4db407294ae90a0d40ef1c46f457f2 NVD, CNA, OSV
- https://git.kernel.org/stable/c/b6e8add5d79d1f6f819a054c833bab452bd7365d NVD, CNA, OSV
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98961.json OSV
- https://nvd.nist.gov/vuln/detail/CVE-2026-98961 OSV