Description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't stash io_uring encoded data across -EAGAIN
Returning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io_uring does not free driver PDU allocations on cleanup.
Write: io_queue_sqe() always issues with IO_URING_F_NONBLOCK first, so return -EAGAIN before allocating and free data on every exit.
Read: free on nowait -EAGAIN too; only -EIOCBQUEUED keeps the allocation for btrfs_uring_read_finished().
Metrics
No CVSS score has been published yet.
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
No affected versions have been published.
Timeline
- Published
- Oct 23, 2026
- Last modified
- Oct 23, 2026
- NVD status
- Received