In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when io_uring read extent fails… (CVE-2026-98961)

The vulnerability in the Linux kernel's Btrfs filesystem concerned the function btrfs_uring_read_extent(), which acquires inode shared and extent locks before proceeding. On failure, specifically when a pages-array allocation failed returning -ENOMEM, the function previously did not unlock these locks, leading to potential lock retention. The fix moves the unlocking responsibility to the caller on all failure returns, consistent with the copy_to_user() error path. The deferred -EIOCBQUEUED path continues to unlock in btrfs_uring_read_finished(). This correction prevents improper lock retention on failure.

Improper unlocking of inode and extent locks on failure could lead to resource locking issues within the Btrfs filesystem, potentially causing system instability or deadlocks. However, no active exploits are known in the wild, and the vulnerability pertains to internal kernel resource management rather than direct code execution or privilege escalation.

A fix has been implemented in the Linux kernel to address this issue by ensuring proper unlocking on all failure paths. Users should update to the patched kernel versions once available. No additional mitigation steps are indicated beyond applying the official fix.