CVE-2026-98961

In the Linux kernel, the following vulnerability has been resolved:

btrfs: unlock inode and extent in caller when io uring read extent fails

btrfs uring read extent() runs only after btrfs encoded read() has taken the inode shared lock and the extent lock. On failure it used to unlock in out fail, and a pages-array allocation failure returned -ENOMEM without unlocking at all.

Unlock in the caller instead on all failure returns, matching the copy to user() error path. The deferred -EIOCBQUEUED path still unlocks in btrfs uring read finished().