In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io_uring encoded data across -EAGAIN Returning -EAGAIN while… (CVE-2026-98960)

The Linux kernel's btrfs filesystem had a vulnerability where io_uring encoded data was improperly retained across -EAGAIN error returns. Specifically, returning -EAGAIN while leaving btrfs_uring_encoded_data in the command PDU could leak data if the request was cancelled or the io_uring ring exited before the request was reissued. The io_uring interface did not free driver PDU allocations on cleanup, leading to potential memory leaks. The remediation involved ensuring that io_queue_sqe() issues with IO_URING_F_NONBLOCK first, returning -EAGAIN before allocating and freeing data on every exit, and freeing allocations on nowait -EAGAIN returns for reads, except when -EIOCBQUEUED is returned to keep allocations for completion.

The vulnerability could lead to information leakage through retained encoded data in memory if requests are cancelled or the io_uring ring exits prematurely. This could expose sensitive data handled by the btrfs filesystem's io_uring operations. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to properly free io_uring encoded data allocations on error returns, preventing data leakage. Users should update to the Linux kernel version that includes this fix. Since no patch links or specific versions are provided, check the official Linux kernel advisories or vendor updates for the fixed version and apply the update accordingly.