---
id: CVE-2026-98961
title: 'btrfs: unlock inode and extent in caller when io_uring read extent fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: unlock inode and extent in caller when io_uring read extent fails

  btrfs_uring_read_extent() runs only after btrfs_encoded_read() has taken
  the inode shared lock…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c <
    2797eb38773a96914ccedeec71eb2144645400b2
  - >-
    Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c <
    ada1fc725a4db407294ae90a0d40ef1c46f457f2
  - >-
    Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c <
    b6e8add5d79d1f6f819a054c833bab452bd7365d
  - Linux 6.13
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:19:29.616Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98961'
references:
  - url: 'https://git.kernel.org/stable/c/2797eb38773a96914ccedeec71eb2144645400b2'
  - url: 'https://git.kernel.org/stable/c/ada1fc725a4db407294ae90a0d40ef1c46f457f2'
  - url: 'https://git.kernel.org/stable/c/b6e8add5d79d1f6f819a054c833bab452bd7365d'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.554Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: unlock inode and extent in caller when io_uring read extent fails

btrfs_uring_read_extent() runs only after btrfs_encoded_read() has taken
the inode shared lock and the extent lock.  On failure it used to unlock
in out_fail, and a pages-array allocation failure returned -ENOMEM
without unlocking at all.

Unlock in the caller instead on all failure returns, matching the
copy_to_user() error path.  The deferred -EIOCBQUEUED path still unlocks
in btrfs_uring_read_finished().

## Affected

- `Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c < 2797eb38773a96914ccedeec71eb2144645400b2`
- `Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c < ada1fc725a4db407294ae90a0d40ef1c46f457f2`
- `Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c < b6e8add5d79d1f6f819a054c833bab452bd7365d`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.