Linux Kernel CVE-2026-74723

Exploitation requires the attacker to supply a specially crafted btrfs filesystem image whose inline LZO-compressed file extent contains only the LZO header, omitting the mandatory segment header and payload; the over-read is maximized when that malformed extent is the first item of a b-tree leaf, placing it at the extent-buffer boundary. The condition is triggered locally when the victim mounts and reads the crafted image (readahead/readpage path), so the attacker needs a way to get such an image mounted - physical/removable-media access, automount, or an untrusted image source. Limiting factors: this is NOT remotely exploitable despite the CVSS AV:N rating, it requires btrfs in use with LZO compression support, and it depends on non-default malicious on-disk data rather than any network-facing service; no user credential is needed beyond the ability to cause the image to be mounted/read.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 CRITICAL) is inconsistent with the described mechanism: exploitation requires reading an inline extent from a crafted btrfs image, which is a LOCAL operation (mounting/reading a malicious filesystem), not a network-reachable attack - the AV:N/PR:N rating appears to be automated NVD scoring that does not reflect reality and should be treated as overstated. Supporting signals reinforce lower real-world urgency: EPSS is only 0.20% (10th percentile), the issue is NOT on CISA KEV, and no POC is referenced. The genuine impact is an out-of-bounds READ, which most plausibly yields a kernel crash/DoS or limited information disclosure, not the confidentiality+integrity+availability 'H/H/H' the input claims. This is a defense-in-depth hardening fix against malicious images (e.g., attacker-supplied USB media or automount scenarios) rather than a mass-exploitable remote vulnerability. Verify with the vendor: CVSS indicates a network vector but the description implies local access via a crafted filesystem image - the network rating is not supported by the technical details.

An attacker crafts a malicious btrfs image containing an inline LZO-compressed file extent that includes only an LZO header (no segment header or payload), placed as the first item of a leaf, then gets it mounted on a target - for example via an attacker-controlled USB drive on a system with automount, or a shared disk image. When any process reads the malformed file, lzo_decompress() reads past the extent-buffer boundary, producing a kernel out-of-bounds read that can crash the system (DoS) or leak adjacent memory. No public exploit is currently identified, and the local-only, crafted-image prerequisite limits practical use.