SB20261023207 - Memory leak in Linux kernel btrfs

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-98962)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel memory, potentially causing a denial of service through memory exhaustion.

The vulnerability exists due to missing release of allocated memory in btrfs_uring_encoded_read() when btrfs_uring_read_extent() fails. A local user can trigger failing encoded read operations to leave the allocated iov buffer unfreed, potentially exhausting kernel memory through repeated failures.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/578ef517142420cf9d36b364ad4b3490b85469fb
• https://git.kernel.org/stable/c/7a3addbdc5ad1fd80541a6a4ff4e06cd1331530a
• https://git.kernel.org/stable/c/a8ea92830b3e0e163d4e829bdcb17ca83c0f951c