SB20261023208 - Double free in Linux kernel btrfs

Description

This security bulletin contains information about 1 vulnerability.

1) Double free (CVE-ID: CVE-2026-98963)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double free in the Btrfs encoded-read completion handling when all bios finish before btrfs_encoded_read_regular_fill_pages() returns and the I/O status indicates an error. A local user can trigger encoded reads that encounter this condition to cause duplicate unlocking and freeing by btrfs_uring_read_extent() and btrfs_uring_read_finished(), potentially crashing the kernel.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/033dda5b321f01661de518a8d5c8607ae8675b14
• https://git.kernel.org/stable/c/80a8dbb30d2b00b9c671b02bd73f700f6d20100f
• https://git.kernel.org/stable/c/a449433b0e3d4a3715d0bbee078f8c603f03c9f6