Vulnerability feed

Executive summary

A fix in the Linux kernel's btrfs file system code resolves a flaw in how encoded reads issued through io_uring are cleaned up. The advisory does not state how severe the flaw is or whether it can be exploited, and it does not give a CVSS score. The change is a kernel stable-tree patch, so the recommended action is to apply the kernel update that contains this commit.

Technical summary

The flaw is a resource handling error in the btrfs encoded read path for io_uring commands. If all bios finish before btrfs_encoded_read_regular_fill_pages() returns, the function returned the I/O status, and a negative errno caused btrfs_uring_read_extent() and btrfs_uring_read_finished() to both unlock and free the same resources. The fix makes the function always return -EIOCBQUEUED so only the deferred path cleans up. The advisory names the fixing commit 80a8dbb30d2b00b9c671b02bd73f700f6d20100f and the Fixes tag 34310c442e17, but it does not state the affected or fixed kernel version numbers, the attack vector or required privileges, a workaround, or any detection guidance. Whether the issue can be triggered by an unprivileged user is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/033dda5b321f016…18a8d5c8607ae8675b14

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernelLinux btrfs

Executive summary

This advisory covers a fix in the Linux kernel's btrfs file system code, where a failed io_uring encoded read could leave a file's inode lock and extent lock held. The advisory describes this as a resolved kernel bug and does not state its severity or give a CVSS score. The fix is to release the locks in the calling code on every failure path, and the advisory does not state any separate action beyond applying the kernel update.

Technical summary

The flaw is a lock handling error in btrfs_uring_read_extent(), where the inode shared lock and extent lock taken by btrfs_encoded_read() were not released when the function failed, and a pages-array allocation failure returned -ENOMEM without unlocking at all. The patch moves the unlock into the caller, btrfs_uring_encoded_read(), for all failure returns, while the deferred -EIOCBQUEUED path still unlocks in btrfs_uring_read_finished(). The advisory names the fix commit as b6e8add5d79d1f6f819a054c833bab452bd7365d and the Fixes tag as 34310c442e17, but it does not state any affected or fixed kernel version numbers. Attack vector, privilege requirements, exploitability, and workarounds are not stated. No detection guidance is given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/2797eb38773a969…deec71eb2144645400b2

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernelLinux btrfs

Executive summary

This advisory describes a resource leak in the Linux kernel's btrfs file system code, where memory used for io_uring encoded reads and writes could be leaked if a request was cancelled or the ring exited before it was reissued. The advisory does not state how serious the issue is, and it does not say whether an attacker could exploit it. The fix is a kernel patch in the stable tree, and the advisory does not state any other vendor recommendation.

Technical summary

The flaw is a memory leak (resource management error) in the btrfs io_uring encoded read and write paths, where data stored in the command PDU across an -EAGAIN return was not freed if the request was cancelled or the ring exited before reissue. The fix returns -EAGAIN before allocation on writes and frees data on nowait -EAGAIN on reads, and clears bc->data after freeing. The advisory does not state the attack vector, required privileges, or CVSS score. It does not state affected or fixed version numbers beyond the referenced fixing commits, and it does not state any workaround or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/4d9c1e0a7fb2cfb…4acafc194d2c15c3e83e

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernelLinux btrfs