Executive brief
The Linux kernel's btrfs filesystem contains a vulnerability in LZO decompression handling that can be triggered when reading a crafted malicious filesystem image. An attacker with the ability to create or modify a filesystem could trigger an out-of-bounds memory read, potentially causing a denial of service or information disclosure on systems that mount the affected filesystem.
Technical details
The vulnerability exists in the lzo_decompress() function within the btrfs filesystem driver. When processing inline LZO-compressed file extents, the code fails to validate that both an LZO header and segment header are present before attempting to read them. A crafted filesystem containing only an LZO header without the required segment header or payload will cause a read beyond the item boundary. This out-of-bounds read can be triggered remotely by mounting a malicious filesystem image, or locally by a user with filesystem creation/modification privileges. The issue is fixed by validating the total length of inline LZO compressed extents to ensure at least one LZO header, one segment header, and non-zero payload are present.
Affected products
- Linux Linux kernel <5.10.187, <5.15.121, <6.1.54, <6.6.14
Timeline
- 2026-08-22: disclosed