---
id: CVE-2026-98962
title: 'btrfs: free iov when btrfs_uring_read_extent() fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: free iov when btrfs_uring_read_extent() fails

  After btrfs_uring_read_extent(), the caller always jumped to out_acct.
  That skips kfree(data->iov), which is only …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c <
    7a3addbdc5ad1fd80541a6a4ff4e06cd1331530a
  - >-
    Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c <
    578ef517142420cf9d36b364ad4b3490b85469fb
  - >-
    Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c <
    a8ea92830b3e0e163d4e829bdcb17ca83c0f951c
  - Linux 6.13
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:19:30.482Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98962'
references:
  - url: 'https://git.kernel.org/stable/c/7a3addbdc5ad1fd80541a6a4ff4e06cd1331530a'
  - url: 'https://git.kernel.org/stable/c/578ef517142420cf9d36b364ad4b3490b85469fb'
  - url: 'https://git.kernel.org/stable/c/a8ea92830b3e0e163d4e829bdcb17ca83c0f951c'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.555Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: free iov when btrfs_uring_read_extent() fails

After btrfs_uring_read_extent(), the caller always jumped to out_acct.
That skips kfree(data->iov), which is only correct for -EIOCBQUEUED
where the deferred path owns the iov. On failure, fall through to
out_free instead.

## Affected

- `Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c < 7a3addbdc5ad1fd80541a6a4ff4e06cd1331530a`
- `Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c < 578ef517142420cf9d36b364ad4b3490b85469fb`
- `Linux >= 34310c442e175f286b4c06ab5caa4e0b267ea31c < a8ea92830b3e0e163d4e829bdcb17ca83c0f951c`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.