Executive brief
A memory management issue was identified in the Linux kernel's Btrfs file system component. A local user could potentially trigger a system slowdown or crash by causing the system to run out of memory through repeated failed file operations. This affects systems using Btrfs with specific io_uring features enabled.
Technical details
A memory leak (CWE-401) exists in the btrfs_uring_read_extent() function within fs/btrfs/ioctl.c. The vulnerability occurs because the 'pages' object is not properly freed during error paths, such as when btrfs_encoded_read_regular_fill_pages() fails to return -EIOCBQUEUED or when other internal allocations fail. An attacker with local access can exploit this by repeatedly triggering these error conditions to exhaust system memory. The issue has been resolved by adding explicit page and pointer cleanup in the out_fail label.
Affected products
- Linux Linux Kernel 6.13 to 6.18.17, 6.19 to 6.19.7
Timeline
- 2026-04-03: disclosed
- 2026-04-03: advisory
- 2026-02-26: patched