Skip to main content

Linux Kernel CVE-2026-80631

| EUVDEUVD-2026-67507 HIGH
2026-08-28 Linux GHSA-hqpg-7vj3-59jv
Buffer Overflow Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Exploitation requires presenting a crafted btrfs image to the kernel, implying local/physical access and at minimum low-privilege access to trigger a mount.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 29, 2026 - 07:39 vuln.today
CVSS changed
Aug 29, 2026 - 07:22 NVD
7.5 (HIGH)
Patch available
Aug 28, 2026 - 09:02 EUVD
CVE Published
Aug 28, 2026 - 06:48 cve.org
HIGH 7.5
CVE Published
Aug 28, 2026 - 06:48 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

btrfs: lzo: reject compressed segment that overflows the compressed input

lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg_len passes the cbuf check but runs past the end of the bio, so copy_compressed_segment() walks off the last folio: get_current_folio() then returns the NULL folio from bio_next_folio(), and with CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults.

BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs/btrfs/lzo.c:383) Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29 Workqueue: btrfs-endio simple_end_io_work kasan_report (mm/kasan/report.c:590) lzo_decompress_bio (fs/btrfs/lzo.c:383) end_bbio_compressed_read (fs/btrfs/compression.c:1065) btrfs_bio_end_io (fs/btrfs/bio.c:135) btrfs_check_read_bio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285) simple_end_io_work process_one_work worker_thread

Reject any segment whose payload would extend beyond compressed_len before copying it, treating it as corruption like the other on-disk validation failures in this function.

AnalysisAI

Null-pointer dereference in the Linux kernel's btrfs LZO decompression path can crash the kernel when reading a crafted compressed extent, causing a denial-of-service. Kernels in the range starting at commit a6e66e6f8c1b685e11b778bef614480a9c1a5278 through the two fix commits are affected across multiple stable branches (5.15 and later). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Step 8
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target system must be running a vulnerable Linux kernel version with btrfs filesystem support compiled in and the btrfs volume must use LZO compression (not zlib or zstd). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 3.1 rates this 7.5 (High) with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting total availability loss with no authentication or complexity requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the upstream fix commits available in the Linux kernel stable tree: b0d27d43791b7a3057c3c4aedf9b4aa033d37c46 (https://git.kernel.org/stable/c/b0d27d43791b7a3057c3c4aedf9b4aa033d37c46) and 1641d058adfbd50cf95d54581ed5d142ee82c07f (https://git.kernel.org/stable/c/1641d058adfbd50cf95d54581ed5d142ee82c07f). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit your infrastructure to identify all systems running Linux kernel versions 5.15 and later. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-80631 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy