CVE-2026-98963

What it actually does

Use-after-free in the btrfs io_uring read path: when all bios complete before btrfs_encoded_read_regular_fill_pages returns, btrfs_uring_read_extent_endio is invoked and the prior code path returned the I/O status directly, causing btrfs_uring_read_extent to unlock and free pages that btrfs_uring_read_finished would then free again.

Why it matters to the business

Kernel memory corruption or crashes on systems using btrfs with io_uring reads, leading to service outages, potential local privilege escalation, and data integrity issues in storage-heavy workloads.

How an attack unfolds

An attacker triggers a specific timing where all block I/O completes synchronously inside the read path, causing the double-free condition during io_uring completion handling; no public exploitation or named actors are associated with this flaw.

How to fix it

Apply the upstream kernel patch that ensures btrfs_uring_read_extent_endio always returns -EIOCBQUEUED; rebuild and deploy the fixed kernel on all affected systems; disable io_uring for btrfs workloads until patched if immediate upgrade is not feasible.

How to confirm the fix worked

Confirm the presence of the corrected return statement in btrfs_uring_read_extent_endio after applying the patch; run regression tests exercising btrfs io_uring read paths under high completion concurrency; verify no double-free warnings appear in kernel logs during those tests.

Typical attack path

1. Mount a btrfs filesystem and enable io_uring support
2. Issue a series of encoded reads that complete all bios before the fill_pages function returns
3. Force the synchronous completion path to invoke both the endio and finished handlers
4. Trigger the double unlock/free sequence to corrupt kernel memory structures

How to detect it

Search kernel logs and audit trails for double-free warnings or slab corruption messages referencing btrfs or io_uring structures around the time of read operations; examine io_uring completion events that coincide with btrfs extent handling.

What your security team should do

• Prioritize patching Linux kernels with btrfs support within the next maintenance window
• Monitor upstream stable releases for the exact fix commit
• Temporarily restrict io_uring usage on btrfs volumes for high-risk systems
• Include btrfs io_uring paths in future kernel fuzzing and static analysis runs