CVE-2026-98960 btrfs: don't stash io_uring encoded data across -EAGAIN
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-98960?
CVE-2026-98960 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't stash io_uring encoded data across -EAGAIN
Returning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io_uring does not free driver PDU allocations on cleanup.
Write: io_queue_sqe() always issues with IO_URING_F_NONBLOCK first, so return -EAGAIN before allocating and free data on every exit.
Read: free on nowait -EAGAIN too; only -EIOCBQUEUED keeps the allocation for btrfs_uring_read_finished().
Which versions are affected by CVE-2026-98960?
How do I fix CVE-2026-98960?
Upgrade to a fixed version.
Is CVE-2026-98960 being exploited?
There is no known exploitation of CVE-2026-98960 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98960, DEBIAN-CVE-2026-98960, GHSA-wr36-cvhp-r8q2, UBUNTU-CVE-2026-98960.