CVE-2026-23423

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23423", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.015Z", "datePublished": "2026-04-03T13:24:31.966Z", "dateUpdated": "2026-05-11T22:06:37.271Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:06:37.271Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free pages on error in btrfs_uring_read_extent()\n\nIn this function the 'pages' object is never freed in the hopes that it is\npicked up by btrfs_uring_read_finished() whenever that executes in the\nfuture. But that's just the happy path. Along the way previous\nallocations might have gone wrong, or we might not get -EIOCBQUEUED from\nbtrfs_encoded_read_regular_fill_pages(). In all these cases, we go to a\ncleanup section that frees all memory allocated by this function without\nassuming any deferred execution, and this also needs to happen for the\n'pages' allocation."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/ioctl.c"], "versions": [{"version": "34310c442e175f286b4c06ab5caa4e0b267ea31c", "lessThan": "d4f210de01eaccac61eee657f676045ef9771d07", "status": "affected", "versionType": "git"}, {"version": "34310c442e175f286b4c06ab5caa4e0b267ea31c", "lessThan": "628895890b0c9ac9129129e89455da7db95ba343", "status": "affected", "versionType": "git"}, {"version": "34310c442e175f286b4c06ab5caa4e0b267ea31c", "lessThan": "3f501412f2079ca14bf68a18d80a2b7a823f1f64", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/ioctl.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d4f210de01eaccac61eee657f676045ef9771d07"}, {"url": "https://git.kernel.org/stable/c/628895890b0c9ac9129129e89455da7db95ba343"}, {"url": "https://git.kernel.org/stable/c/3f501412f2079ca14bf68a18d80a2b7a823f1f64"}], "title": "btrfs: free pages on error in btrfs_uring_read_extent()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/btrfs/ioctl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d4f210de01eaccac61eee657f676045ef9771d07", "status": "affected", "version": "34310c442e175f286b4c06ab5caa4e0b267ea31c", "versionType": "git"}, {"lessThan": "628895890b0c9ac9129129e89455da7db95ba343", "status": "affected", "version": "34310c442e175f286b4c06ab5caa4e0b267ea31c", "versionType": "git"}, {"lessThan": "3f501412f2079ca14bf68a18d80a2b7a823f1f64", "status": "affected", "version": "34310c442e175f286b4c06ab5caa4e0b267ea31c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/btrfs/ioctl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.17", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "40E7536C-DA22-4B7D-9953-0343B4D9A3E6", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.13.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*", "matchCriteriaId": "5A3F9505-6B98-4269-8B81-127E55A1BF00", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free pages on error in btrfs_uring_read_extent()\n\nIn this function the 'pages' object is never freed in the hopes that it is\npicked up by btrfs_uring_read_finished() whenever that executes in the\nfuture. But that's just the happy path. Along the way previous\nallocations might have gone wrong, or we might not get -EIOCBQUEUED from\nbtrfs_encoded_read_regular_fill_pages(). In all these cases, we go to a\ncleanup section that frees all memory allocated by this function without\nassuming any deferred execution, and this also needs to happen for the\n'pages' allocation."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbtrfs: liberar p\u00e1ginas en caso de error en btrfs_uring_read_extent()\n\nEn esta funci\u00f3n, el objeto 'pages' nunca se libera con la esperanza de que sea recogido por btrfs_uring_read_finished() cada vez que se ejecute en el futuro. Pero ese es solo el camino feliz. En el camino, asignaciones anteriores podr\u00edan haber salido mal, o podr\u00edamos no obtener -EIOCBQUEUED de btrfs_encoded_read_regular_fill_pages(). En todos estos casos, vamos a una secci\u00f3n de limpieza que libera toda la memoria asignada por esta funci\u00f3n sin asumir ninguna ejecuci\u00f3n diferida, y esto tambi\u00e9n debe ocurrir para la asignaci\u00f3n de 'pages'."}], "id": "CVE-2026-23423", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-03T14:16:28.487", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3f501412f2079ca14bf68a18d80a2b7a823f1f64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/628895890b0c9ac9129129e89455da7db95ba343"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d4f210de01eaccac61eee657f676045ef9771d07"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: btrfs: free pages on error in btrfs_uring_read_extent()", "id": "2454779", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454779"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's btrfs file system. This vulnerability occurs in the `btrfs_uring_read_extent()` function, where memory allocated for 'pages' is not properly freed when errors occur during read operations. This oversight can lead to resource exhaustion, potentially causing a Denial of Service (DoS) for affected systems."], "name": "CVE-2026-23423", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23423\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23423\nhttps://lore.kernel.org/linux-cve-announce/2026040304-CVE-2026-23423-96fa@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34310c442e175f286b4c06ab5caa4e0b267ea31c,d4f210de01eaccac61eee657f676045ef9771d07)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34310c442e175f286b4c06ab5caa4e0b267ea31c,628895890b0c9ac9129129e89455da7db95ba343)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[34310c442e175f286b4c06ab5caa4e0b267ea31c,3f501412f2079ca14bf68a18d80a2b7a823f1f64)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T16:46:51.069369+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that incorporates the fix for CVE-2026-23423. This will release the unfreed pages during error handling.", "If an immediate kernel update is not feasible, apply the specific commit referenced in the provided links to the kernel source tree, rebuild, and reboot the system.", "Monitor kernel memory usage for sustained increases that could indicate the presence of the leak, and isolate affected hosts until a patch is applied."], "summary": {"action": "Apply patch", "impact": "Memory Leak leading to possible Denial of Service"}, "threat_synthesis": {"affected_systems": "The issue affects the Linux kernel, specifically the Btrfs subsystem in all kernel releases that lack the committed fix. No explicit version range is provided; any kernel still containing the pre\u2011fix code is susceptible.", "description_and_impact": "The vulnerability arises from an oversight in the btrfs file system\u2019s URING read handler, where the pages buffer is not freed during error conditions. This can cause kernel memory to be held indefinitely, allowing an attacker who can trigger repeated read errors to deplete system memory and potentially crash or degrade the host. The weakness is a classic memory management flaw, documented as CWE-401 and CWE-772.", "risk_and_exploitability": "With a CVSS score of 5.5, the severity is moderate, and the EPSS score is under 1\u202f%, indicating a low likelihood of widespread exploitation. The flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be a local or privileged user capable of inducing read errors on Btrfs volumes, as the memory leak occurs within kernel land."}}}}, "created": "2026-04-03T21:14:15.719694+00:00", "updated": "2026-04-28T17:00:13.412434+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}