CVE-2026-23423
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Btrfs filesystem in the Linux kernel, a memory leak occurs in btrfs_uring_read_extent(). The 'pages' object is not freed in error paths when previous allocations fail or when btrfs_encoded_read_regular_fill_pages() does not return -EIOCBQUEUED.
Risk Assessment
Memory leak can exhaust kernel memory and cause system instability, especially under heavy io_uring read operations.
Recommendation
Apply the patch that adds freeing of the 'pages' object in the cleanup section for all error paths.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: btrfs: free pages on error in btrfs_uring_read_extent() In this function the 'pages' object is never freed in the hopes that it is picked up by btrfs_uring_read_finished() whenever that executes in the future. But that's just the happy path. Along the way previous allocations might have gone wrong, or we might not get -EIOCBQUEUED from btrfs_encoded_read_regular_fill_pages(). In all these cases, we go to a cleanup section that frees all memory allocated by this function without assuming any deferred execution, and this also needs to happen for the 'pages' allocation.