In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio If all… (CVE-2026-98963)

The Linux kernel Btrfs subsystem had a flaw where btrfs_uring_read_extent_endio returned the I/O status directly. If all bios completed before btrfs_encoded_read_regular_fill_pages() returned, this caused btrfs_uring_read_extent() to unlock and free resources, and then btrfs_uring_read_finished() would do the same again, resulting in double cleanup. The fix was to always return -EIOCBQUEUED to ensure only the deferred cleanup path handles resource freeing, preventing double free or use-after-free scenarios.

The vulnerability could lead to improper resource management such as double freeing or use-after-free in the Btrfs filesystem code, which may cause kernel instability or crashes. No direct exploit or active exploitation is known.

A fix has been applied in the Linux kernel to always return -EIOCBQUEUED after btrfs_uring_read_extent_endio, preventing double cleanup. Users should update to a kernel version that includes this fix once available. Patch status is not explicitly confirmed in the provided data; verify with the official Linux kernel advisories for the exact fixed versions.