CVE-2026-23423

Vulnerability

A memory leak exists in the Linux kernel's btrfs_uring_read_extent() function within the Btrfs file system. The function allocates a pages object that is normally freed by btrfs_uring_read_finished() on success. However, on error paths—such as when earlier allocations fail or btrfs_encoded_read_regular_fill_pages() does not return -EIOCBQUEUED—the function jumps to a cleanup section that frees other allocated memory but omits freeing pages, causing it to be leaked [1][2][3].

Exploitation

To trigger this vulnerability, an attacker must have the ability to perform file read operations using io_uring on a Btrfs filesystem. The error path can be reached under conditions that cause allocation failures or unexpected return values, for example, during low-memory situations or by inducing I/O errors. No special privileges are required beyond local access to trigger the operations.

Impact

An unprivileged local user can exploit this memory leak to gradually exhaust system memory, potentially leading to a denial-of-service (DoS) condition. Over time, repeated exploitation could deplete available memory, causing system instability or crashes.

Mitigation

The issue is fixed in Linux kernel stable commits [1][2][3]. Users should update to a patched kernel version that includes the fix, which ensures pages is freed in all cleanup paths.