CVE-2026-98960 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't stash io_uring encoded data across -EAGAIN
Returning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io_uring does not free driver PDU allocations on cleanup.
Write: io_queue_sqe() always issues with IO_URING_F_NONBLOCK first, so return -EAGAIN before allocating and free data on every exit.
Read: free on nowait -EAGAIN too; only -EIOCBQUEUED keeps the allocation for btrfs_uring_read_finished().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel's Btrfs filesystem implementation contained a memory leak vulnerability within its io_uring interface, specifically involving the handling of encoded data during asynchronous I/O operations. This flaw arises from an improper management lifecycle of driver Protocol Data Units (PDUs) when specific error conditions are encountered. In systems utilizing io_uring for high-performance input and output, efficient resource cleanup is critical to prevent memory exhaustion over time. The vulnerability manifests primarily in scenarios where the kernel attempts to issue a request that cannot be completed immediately due to temporary unavailability of resources or contention, resulting in an -EAGAIN return code. Under these circumstances, if the associated data structures are retained without proper deallocation logic for all exit paths, they remain allocated even when the user-space application cancels the operation or closes the io_uring ring context before reissuing the request.
From a technical perspective, the root cause lies in the asymmetry of resource allocation and cleanup within the btrfs_uring_read_write functions. The code path for write operations initially attempted to queue requests with non-blocking flags but failed to ensure that allocated encoded data was freed upon every possible exit condition, particularly when an -EAGAIN error occurred prior to successful queuing or during cancellation. Similarly, read operations suffered from incomplete cleanup logic where allocations were preserved in cases of immediate failure (-EAGAIN) rather than being released immediately. This behavior violates the principle of least privilege regarding resource consumption and creates a classic memory leak scenario. Since io_uring does not automatically free driver-specific PDU allocations upon ring teardown or request cancellation, any data left behind by the filesystem driver accumulates in kernel space, leading to gradual degradation of system performance and potential denial of service through memory exhaustion under sustained load.
The operational impact of this vulnerability is primarily related to resource stability rather than direct security exploitation such as arbitrary code execution. However, persistent memory leaks in the kernel can lead to significant availability issues. Over time, the accumulation of unreleased memory fragments increases pressure on the system's physical and virtual memory pools. In high-throughput environments where io_uring is heavily utilized for storage operations, this leak could trigger out-of-memory conditions or force the kernel to invoke its aggressive reclaim mechanisms, potentially causing latency spikes or process termination. Furthermore, while less likely in this specific context, excessive allocation of kernel structures can sometimes provide a larger attack surface for other memory-corruption vulnerabilities if heap layout is significantly altered by repeated allocations and partial frees.
To mitigate this vulnerability, developers must ensure that all code paths involving io_uring requests properly handle resource deallocation upon error conditions. Specifically, the logic governing write operations should be adjusted to return -EAGAIN before allocating encoded data whenever possible, thereby avoiding unnecessary allocation in non-blocking scenarios where failure is anticipated or likely. For read operations, the cleanup routine must explicitly free allocated buffers when encountering a nowait -EAGAIN condition, ensuring that only successful queueing via IO_URING_F_NONBLOCK retains the allocation for later completion handling by btrfs_uring_read_finished. This correction aligns with standard practices in kernel development where every allocation must have a corresponding and guaranteed deallocation path across all control flow branches.
This issue is categorized under CWE-401, which describes missing release of memory after effective usage, highlighting the failure to properly manage dynamic memory resources within the operating system core. From an adversarial perspective, while this specific flaw does not directly enable privilege escalation or remote code execution, it contributes to a broader class of availability attacks documented in MITRE ATT&CK techniques related to resource exhaustion and denial of service through application-level abuse of kernel subsystems. By resolving these leaks, the stability and reliability of Btrfs on io_uring are significantly improved, ensuring that temporary I/O contention does not result in permanent memory loss within the kernel address space.