Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs_uring_read_extent() fails After btrfs_uring_read_extent(), the caller always jumped to out_acct. That skips kfree(data->iov), which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure, fall through to out_free instead.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 34310c442e175f286b4c06ab5caa4e0b267ea31c before 7a3addbdc5ad1fd80541a6a4ff4e06cd1331530a; affected 34310c442e175f286b4c06ab5caa4e0b267ea31c before 578ef517142420cf9d36b364ad4b3490b85469fb; affected 34310c442e175f286b4c06ab5caa4e0b267ea31c before a8ea92830b3e0e163d4e829bdcb17ca83c0f951c |
| Linux / Linux | affected 6.13; unaffected 0 before 6.13; unaffected 6.18.57 through 6.18.*; unaffected 7.2.11 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.