{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23423", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.015Z", "datePublished": "2026-04-03T13:24:31.966Z", "dateUpdated": "2026-04-03T13:24:31.966Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-04-03T13:24:31.966Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free pages on error in btrfs_uring_read_extent()\n\nIn this function the 'pages' object is never freed in the hopes that it is\npicked up by btrfs_uring_read_finished() whenever that executes in the\nfuture. But that's just the happy path. Along the way previous\nallocations might have gone wrong, or we might not get -EIOCBQUEUED from\nbtrfs_encoded_read_regular_fill_pages(). In all these cases, we go to a\ncleanup section that frees all memory allocated by this function without\nassuming any deferred execution, and this also needs to happen for the\n'pages' allocation."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/ioctl.c"], "versions": [{"version": "34310c442e175f286b4c06ab5caa4e0b267ea31c", "lessThan": "d4f210de01eaccac61eee657f676045ef9771d07", "status": "affected", "versionType": "git"}, {"version": "34310c442e175f286b4c06ab5caa4e0b267ea31c", "lessThan": "628895890b0c9ac9129129e89455da7db95ba343", "status": "affected", "versionType": "git"}, {"version": "34310c442e175f286b4c06ab5caa4e0b267ea31c", "lessThan": "3f501412f2079ca14bf68a18d80a2b7a823f1f64", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/ioctl.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.0-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d4f210de01eaccac61eee657f676045ef9771d07"}, {"url": "https://git.kernel.org/stable/c/628895890b0c9ac9129129e89455da7db95ba343"}, {"url": "https://git.kernel.org/stable/c/3f501412f2079ca14bf68a18d80a2b7a823f1f64"}], "title": "btrfs: free pages on error in btrfs_uring_read_extent()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free pages on error in btrfs_uring_read_extent()\n\nIn this function the 'pages' object is never freed in the hopes that it is\npicked up by btrfs_uring_read_finished() whenever that executes in the\nfuture. But that's just the happy path. Along the way previous\nallocations might have gone wrong, or we might not get -EIOCBQUEUED from\nbtrfs_encoded_read_regular_fill_pages(). In all these cases, we go to a\ncleanup section that frees all memory allocated by this function without\nassuming any deferred execution, and this also needs to happen for the\n'pages' allocation."}], "id": "CVE-2026-23423", "lastModified": "2026-04-03T16:10:23.730", "metrics": {}, "published": "2026-04-03T14:16:28.487", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3f501412f2079ca14bf68a18d80a2b7a823f1f64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/628895890b0c9ac9129129e89455da7db95ba343"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d4f210de01eaccac61eee657f676045ef9771d07"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: btrfs: free pages on error in btrfs_uring_read_extent()", "id": "2454779", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454779"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's btrfs file system. This vulnerability occurs in the `btrfs_uring_read_extent()` function, where memory allocated for 'pages' is not properly freed when errors occur during read operations. This oversight can lead to resource exhaustion, potentially causing a Denial of Service (DoS) for affected systems."], "name": "CVE-2026-23423", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23423\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23423\nhttps://lore.kernel.org/linux-cve-announce/2026040304-CVE-2026-23423-96fa@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34310c442e175f286b4c06ab5caa4e0b267ea31c,d4f210de01eaccac61eee657f676045ef9771d07)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34310c442e175f286b4c06ab5caa4e0b267ea31c,628895890b0c9ac9129129e89455da7db95ba343)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34310c442e175f286b4c06ab5caa4e0b267ea31c,3f501412f2079ca14bf68a18d80a2b7a823f1f64)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-03T16:36:41.203558+00:00", "value": {"mitigation_remediation": ["Apply the kernel patch referenced in the advisory (see git commits 3f501412f2079ca14bf68a18d80a2b7a823f1f64, 628895890b0c9ac9129129e89455da7db95ba343, d4f210de01eaccac61eee657f676045ef9771d07).", "Upgrade to a kernel version that includes the fix, following the vendor\u2019s release notes for your distribution."], "summary": {"action": "Upgrade Kernel", "impact": "Memory Leak (Potential DoS)"}, "threat_synthesis": {"affected_systems": "All Linux kernel distributions that incorporate the buggy btrfs implementation are affected, regardless of vendor, as the issue resides in the core kernel component. No specific version boundaries are listed, so any release prior to the patch should be treated as vulnerable.", "description_and_impact": "The vulnerability arises from the btrfs_uring_read_extent() function in the Linux kernel, where a pages object is never freed under error conditions. The cleanup path fails to release this allocation, leading to a memory leak. Over time, repeated errors could consume significant memory resources, degrading system performance or crashing the system, effectively creating a denial\u2011of\u2011service scenario.", "risk_and_exploitability": "The CVSS score is not provided, and the EPSS score is unavailable, but the potential for prolonged memory exhaustion suggests a moderate to high risk in environments under sustained error conditions. No CISA KEV listing indicates the vulnerability has not yet been observed in widespread exploitation. The likely attack vector is via local attempts to trigger read errors on Btrfs volumes; remote exploitation would require an attacker to influence kernel error paths from outside the kernel, which is unlikely without existing local privileges."}}}}, "created": "2026-04-03T21:14:15.719694+00:00", "updated": "2026-04-03T21:16:31.428945+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-401"]}