EUVD-2026-64410
GHSA-prr6-m9gq-386w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires locally mounting/reading a crafted btrfs image (AV:L, PR:L); an out-of-bounds read yields kernel crash (A:H) and limited info leak (C:L), with no integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
btrfs: lzo: reject inline extents without valid headers
[BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent:
BUG: KASAN: slab-out-of-bounds in lzo_decompress+0x57d/0x700 Read of size 4 at addr ffff888006f2e644 by task btrfs_lzo_inlin/77
Call Trace: <TASK> dump_stack_lvl+0x5b/0x70 print_report+0xd1/0x610 kasan_report+0xe0/0x110 __asan_report_load_n_noabort+0x13/0x20 lzo_decompress+0x57d/0x700 btrfs_decompress+0x140/0x1c0 uncompress_inline+0x147/0x1b0 btrfs_get_extent+0xb23/0x10a0 btrfs_do_readpage.constprop.0+0x538/0x1ac0 btrfs_readahead+0x32f/0x5f0 read_pages+0x16f/0x850 page_cache_ra_unbounded+0x296/0x490 do_page_cache_ra+0xd9/0x130 page_cache_sync_ra+0x3ee/0x6f0 filemap_get_pages+0x306/0x15c0 filemap_read+0x329/0xd00 btrfs_file_read_iter+0x1f8/0x2b0 vfs_read+0x4ef/0x720 ksys_read+0xf8/0x1d0 __x64_sys_read+0x71/0xb0 x64_sys_call+0x1ab0/0x1b70 do_syscall_64+0x61/0x470 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>
[CAUSE] For an inline lzo compressed file extent, there should always be one lzo header, recording the total length of the compressed data, followed by one segment header, recording the compressed lzo payload.
But if a crafted inline lzo compressed file extent contains only an lzo header, without the segment header or payload, lzo_decompress() will still try to read the segment header, causing a read beyond the item boundary.
Furthermore if the inline lzo compressed file extent is the first item of the leaf, it will be at the extent buffer boundary. The above out-of-boundary read will go beyond the extent buffer boundary, triggering the above KASAN report.
[FIX] Validate the total length of the inlined lzo compressed file extent, to make sure there is at least one LZO header and one segment header, and a non-zero payload.
[ Rework the commit message to remove slop ]
AnalysisAI
Out-of-bounds read in the Linux kernel btrfs LZO decompression path allows a crafted btrfs filesystem image to trigger a slab-out-of-bounds (and potentially extent-buffer-boundary) read when an inline LZO-compressed file extent is read. The flaw affects the kernel's btrfs module from 2.6.38 onward and is fixed upstream; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to supply a specially crafted btrfs filesystem image whose inline LZO-compressed file extent contains only the LZO header, omitting the mandatory segment header and payload; the over-read is maximized when that malformed extent is the first item of a b-tree leaf, placing it at the extent-buffer boundary. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 CRITICAL) is inconsistent with the described mechanism: exploitation requires reading an inline extent from a crafted btrfs image, which is a LOCAL operation (mounting/reading a malicious filesystem), not a network-reachable attack - the AV:N/PR:N rating appears to be automated NVD scoring that does not reflect reality and should be treated as overstated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious btrfs image containing an inline LZO-compressed file extent that includes only an LZO header (no segment header or payload), placed as the first item of a leaf, then gets it mounted on a target - for example via an attacker-controlled USB drive on a system with automount, or a shared disk image. When any process reads the malformed file, lzo_decompress() reads past the extent-buffer boundary, producing a kernel out-of-bounds read that can crash the system (DoS) or leak adjacent memory. … |
| Remediation | Vendor-released patch: update to a Linux stable kernel containing the fix - the EUVD data cites patched stable releases 7.2 and 7.1.9, corresponding to upstream stable commits fc50b475ad27f50b4dcc98fc4c44e8802bc1b248 (https://git.kernel.org/stable/c/fc50b475ad27f50b4dcc98fc4c44e8802bc1b248) and 0fa78ef637deb5dbe341582f88553a4bce496de0 (https://git.kernel.org/stable/c/0fa78ef637deb5dbe341582f88553a4bce496de0); apply your distribution's corresponding kernel update rather than the mainline version string where applicable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running kernel 2.6.38 or later with btrfs support enabled and document current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today