---
id: CVE-2026-98960
title: 'btrfs: don''t stash io_uring encoded data across -EAGAIN'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: don't stash io_uring encoded data across -EAGAIN

  Returning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU
  leaks if the request is cancelled or th…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c <
    4d9c1e0a7fb2cfb1cc924acafc194d2c15c3e83e
  - >-
    Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c <
    51562a8cb11628d3a5e105b4c347ec5473e5745f
  - Linux 6.13
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:19:28.651Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98960'
references:
  - url: 'https://git.kernel.org/stable/c/4d9c1e0a7fb2cfb1cc924acafc194d2c15c3e83e'
  - url: 'https://git.kernel.org/stable/c/51562a8cb11628d3a5e105b4c347ec5473e5745f'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.554Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: don't stash io_uring encoded data across -EAGAIN

Returning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU
leaks if the request is cancelled or the ring exits before reissue.
io_uring does not free driver PDU allocations on cleanup.

Write: io_queue_sqe() always issues with IO_URING_F_NONBLOCK first, so
return -EAGAIN before allocating and free data on every exit.

Read: free on nowait -EAGAIN too; only -EIOCBQUEUED keeps the allocation
for btrfs_uring_read_finished().

## Affected

- `Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c < 4d9c1e0a7fb2cfb1cc924acafc194d2c15c3e83e`
- `Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c < 51562a8cb11628d3a5e105b4c347ec5473e5745f`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.