In the Linux kernel, the following vulnerability has been resolved:
btrfs: free pages on error in btrfs_uring_read_extent()
In this function the 'pages' object is never freed in the hopes that it is picked up by btrfs_uring_read_finished() whenever that executes in the future. But that's just the happy path. Along the way previous allocations might have gone wrong, or we might not get -EIOCBQUEUED from btrfs_encoded_read_regular_fill_pages(). In all these cases, we go to a cleanup section that frees all memory allocated by this function without assuming any deferred execution, and this also needs to happen for the 'pages' allocation.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.18-toolsUpgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-libbpf-staticUpgrade kernel6.18-develUpgrade kernel6.18-tools-develUpgrade kernel6.18-libbpf-develUpgrade kernel6.18-debuginfoUpgrade perf6.18-debuginfoUpgrade kernel6.18-libbpfUpgrade kernel-livepatch-6.18.20-20.229Upgrade kernel6.18-modules-extraUpgrade bpftool6.18-debuginfoUpgrade kernel6.18-headersUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18Upgrade kernel6.18-libbpf-debuginfoUpgrade perf6.18Upgrade kernel6.18-debuginfo-common-aarch64Upgrade bpftool6.18Upgrade python3-perf6.18Upgrade python3-perf6.18-debuginfoUpgrade kernel6.18-tools-debuginfo | May 4, 2026 | Apr 3, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Apr 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub