CVE-2026-98963 btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio

Not scored Published 23 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-98963?

CVE-2026-98963 is a vulnerability in Linux, published on 23 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio

If all bios finish before btrfs_encoded_read_regular_fill_pages() returns, it calls btrfs_uring_read_extent_endio() and previously returned the I/O status. A negative errno then made btrfs_uring_read_extent() unlock and free while btrfs_uring_read_finished() did the same again.

Return -EIOCBQUEUED so only the deferred path cleans up.

Which versions are affected by CVE-2026-98963?

How do I fix CVE-2026-98963?

Upgrade to a fixed version.

Is CVE-2026-98963 being exploited?

There is no known exploitation of CVE-2026-98963 in the wild and no public exploit code.

Sources

Also known as BELL-CVE-2026-98963, DEBIAN-CVE-2026-98963, GHSA-j8f6-2rjf-qjg6, UBUNTU-CVE-2026-98963.