CVE-2026-80631
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg_len passes the cbuf check but runs past the end of the bio, so copy_compressed_segment() walks off the last folio: get_current_folio() then returns the NULL folio from bio_next_folio(), and with CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults. BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs/btrfs/lzo.c:383) Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29 Workqueue: btrfs-endio simple_end_io_work kasan_report (mm/kasan/report.c:590) lzo_decompress_bio (fs/btrfs/lzo.c:383) end_bbio_compressed_read (fs/btrfs/compression.c:1065) btrfs_bio_end_io (fs/btrfs/bio.c:135) btrfs_check_read_bio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285) simple_end_io_work process_one_work worker_thread Reject any segment whose payload would extend beyond compressed_len before copying it, treating it as corruption like the other on-disk validation failures in this function.
View original CVE JSON
{
"id": "CVE-2026-80631",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-08-28T08:16:48.010",
"lastModified": "2026-10-30T13:20:08.623",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: lzo: reject compressed segment that overflows the compressed input\n\nlzo_decompress_bio() validates each on-disk segment length seg_len only\nagainst the workspace cbuf size, not against the compressed input size\n(compressed_len, the total folio bytes of the bio). A crafted extent can\ncarry a segment whose seg_len passes the cbuf check but runs past the end\nof the bio, so copy_compressed_segment() walks off the last folio:\nget_current_folio() then returns the NULL folio from bio_next_folio(), and\nwith CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults.\n\n BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs/btrfs/lzo.c:383)\n Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29\n Workqueue: btrfs-endio simple_end_io_work\n kasan_report (mm/kasan/report.c:590)\n lzo_decompress_bio (fs/btrfs/lzo.c:383)\n end_bbio_compressed_read (fs/btrfs/compression.c:1065)\n btrfs_bio_end_io (fs/btrfs/bio.c:135)\n btrfs_check_read_bio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285)\n simple_end_io_work\n process_one_work\n worker_thread\n\nReject any segment whose payload would extend beyond compressed_len before\ncopying it, treating it as corruption like the other on-disk validation\nfailures in this function."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/btrfs/lzo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"lessThan": "e4325fb00e0c7269cb67f97d7148507787a57fd7",
"versionType": "git",
"status": "affected"
},
{
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"lessThan": "d9b17f9ce67d00e48fab62dcae197612a58f625f",
"versionType": "git",
"status": "affected"
},
{
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"lessThan": "1c48c8c807e49ac4f72819a89035fb8d2d094015",
"versionType": "git",
"status": "affected"
},
{
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"lessThan": "be7fb59512ffc2da5d98214a00117dfe9eccab78",
"versionType": "git",
"status": "affected"
},
{
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"lessThan": "1641d058adfbd50cf95d54581ed5d142ee82c07f",
"versionType": "git",
"status": "affected"
},
{
"version": "a6e66e6f8c1b685e11b778bef614480a9c1a5278",
"lessThan": "b0d27d43791b7a3057c3c4aedf9b4aa033d37c46",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/btrfs/lzo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.15",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.15",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.114",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.57",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.5",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1641d058adfbd50cf95d54581ed5d142ee82c07f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1c48c8c807e49ac4f72819a89035fb8d2d094015",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b0d27d43791b7a3057c3c4aedf9b4aa033d37c46",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/be7fb59512ffc2da5d98214a00117dfe9eccab78",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d9b17f9ce67d00e48fab62dcae197612a58f625f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e4325fb00e0c7269cb67f97d7148507787a57fd7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}