Executive brief
The Linux kernel's Btrfs filesystem implementation contains a vulnerability in its LZO decompression logic that can be triggered by a crafted compressed file extent. An attacker with the ability to create or control a malicious filesystem image can cause a null pointer dereference or kernel crash, disrupting system availability or potentially enabling privilege escalation on affected systems.
Technical details
The vulnerability is a buffer over-read in the Btrfs LZO decompression function lzo_decompress_bio() (fs/btrfs/lzo.c). The function validates each compressed segment's length (seg_len) only against the workspace buffer size (cbuf), but fails to validate that the segment does not extend beyond the total compressed input size (compressed_len). A crafted filesystem can provide a segment length that passes the cbuf check but overflows the compressed input, causing copy_compressed_segment() to read past the end of the bio's folios. When CONFIG_BTRFS_ASSERT is disabled (the default), this results in a null pointer dereference when folio_size(NULL) is called, triggering a KASAN error and kernel crash. The fix adds a validation check to reject segments where cur_in + seg_len exceeds compressed_len before copying, treating such malformed extents as corruption.
Affected products
- Linux Linux kernel Linux 4.0 through 6.18 and later (exact vulnerable range varies by stable series)
Timeline
- 2026-08-28: disclosed: CVE-2026-80631 published
- 2026-06-09: patched: Fix committed upstream as b0d27d43791b7a3057c3c4aedf9b4aa033d37c46