In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs_uring_read_extent() fails After… (CVE-2026-98962)

The Linux kernel contained a vulnerability in the btrfs filesystem code where after a call to btrfs_uring_read_extent(), the caller would jump directly to an error handling label (out_acct) that skipped freeing the iov memory buffer (data->iov). This behavior was only correct for the specific error code -EIOCBQUEUED, where a deferred path owns the iov. For other failure cases, the iov memory was not freed, causing a resource leak. The fix changes the control flow so that on failure, the code falls through to out_free, ensuring proper deallocation of the iov memory.

The vulnerability could lead to a memory leak in the Linux kernel's btrfs filesystem code when btrfs_uring_read_extent() fails with error codes other than -EIOCBQUEUED. This may degrade system stability or performance over time due to unreleased memory. There is no indication of direct exploitation or privilege escalation from the provided data.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the fixed kernel version once it is released. Since this is a kernel-level fix, applying the official kernel update from the Linux distribution vendor is the recommended remediation. No additional mitigation steps are indicated.