Linux Kernel CVE-2026-80631

The target system must be running a vulnerable Linux kernel version with btrfs filesystem support compiled in and the btrfs volume must use LZO compression (not zlib or zstd). The attacker must be able to cause the kernel to read a crafted btrfs extent - this requires either mounting a malicious btrfs image (which on most hardened systems requires root or CAP_SYS_ADMIN), leveraging a network block device or iSCSI target controlled by the attacker, or exploiting unprivileged user-namespace mounts on distributions that enable kernel.unprivileged_userns_clone (Ubuntu, Debian defaults). CONFIG_BTRFS_ASSERT must be disabled, which is the default in all production kernel builds. The vulnerability is limited to the kernel availability domain (crash/panic); it provides no code execution, privilege escalation, or data exfiltration capability. Exploitation is limited to systems actively reading btrfs data with LZO-compressed extents and does not affect btrfs mounts using other compression algorithms.

CVSS 3.1 rates this 7.5 (High) with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting total availability loss with no authentication or complexity requirement. However, the AV:N assignment warrants scrutiny: exploiting this requires delivering a crafted btrfs image to the kernel, which in practice means mounting a malicious filesystem, using a network-backed block device, or leveraging unprivileged user-namespace mounts where the distro permits them. The practical attack complexity is therefore higher than AC:L implies in most production environments. EPSS at 0.15% (5th percentile) corroborates low real-world exploitation interest. No KEV listing and no POC are confirmed. Impact is strictly availability (kernel panic/crash) with no confidentiality or integrity component. For systems running btrfs with LZO compression, this is a real but non-urgent patch priority; for systems not using btrfs or using zlib/zstd compression, risk is negligible. The NVD CVSS vector's PR:N may overstate unauthenticated reachability in standard server configurations.

An attacker with the ability to present a malicious btrfs filesystem image to a target system - for example, via a crafted USB drive, network block device, or unprivileged user namespace mount on permissive distributions - creates an LZO-compressed extent whose seg_len field passes the workspace cbuf bounds check but exceeds the bio's total compressed_len. When the kernel's btrfs endio workqueue reads and decompresses this extent, copy_compressed_segment walks off the last folio, bio_next_folio returns NULL, and folio_size(NULL) triggers a null-pointer dereference, crashing the kernel. No public POC has been identified at time of analysis.