Use-After-Free Memory Leak in Linux Kernel btrfs_uring_read_extent

Publication date: 2026-04-03

Last updated on: 2026-04-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: free pages on error in btrfs_uring_read_extent() In this function the 'pages' object is never freed in the hopes that it is picked up by btrfs_uring_read_finished() whenever that executes in the future. But that's just the happy path. Along the way previous allocations might have gone wrong, or we might not get -EIOCBQUEUED from btrfs_encoded_read_regular_fill_pages(). In all these cases, we go to a cleanup section that frees all memory allocated by this function without assuming any deferred execution, and this also needs to happen for the 'pages' allocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-03

Last Modified

2026-04-23

Generated

2026-07-06

AI Q&A

2026-04-03

EPSS Evaluated

2026-07-05

NVD

CVE-2026-23423

EUVD

EUVD-2026-18643

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.13
linux	linux_kernel	From 6.19 (inc) to 6.19.7 (exc)
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.13.1 (inc) to 6.18.17 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's btrfs filesystem code, specifically in the function btrfs_uring_read_extent(). The issue is that a 'pages' object allocated during this function is not properly freed in error cases. The code assumes that the 'pages' object will be freed later by another function (btrfs_uring_read_finished()), but this only happens in the normal (happy) path. If an error occurs during allocation or reading, the cleanup code frees all other allocated memory but neglects to free the 'pages' object, leading to a potential memory leak.

Impact Analysis

The primary impact of this vulnerability is a memory leak in the Linux kernel's btrfs filesystem code. Over time, repeated triggering of this error path could cause increased memory usage, potentially leading to system instability or degraded performance due to exhaustion of available memory.

Hi! I’m here to help you understand CVE-2026-23423. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70