Skip to main content

Linux Kernel EUVDEUVD-2026-86201

| CVE-2026-93813 HIGH
2026-09-24 Linux GHSA-63fr-ch28-f5vq
Denial Of Service Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious btrfs image with namelen=4096
  2. Delivery
    Deliver image to victim (USB/loopback/container)
  3. Exploit
    Victim mounts or parses filesystem
  4. Execution
    OOB memcpy past 255-byte name buffer
  5. Impact
    Kernel page fault and panic (DoS)

Vulnerability Assessment

Exploitation Conditions

Requires the attacker to supply a crafted btrfs filesystem image (with an INODE_REF item whose namelen=4096 exceeds BTRFS_NAME_LEN=255) AND to get the victim to mount or otherwise parse it - the crash trace specifically routes through btrfs_get_name via reconnect_path/exportfs_decode_fh_raw, i.e. the inode-ref/get_name lookup or NFS/open_by_handle export path. Limiting factors: local access is required (AV:L), the attacker cannot exploit a normally-running system remotely, exploitation depends on mount privileges (physical media, unprivileged user-namespace mounts, or container/loopback images), and the affected kernel must lack the tree-checker namelen validation. It only affects systems using btrfs.
Impact

This is a memory-safety flaw in the Linux kernel's btrfs tree-checker: the INODE_REF item's name length (namelen) is not validated against the BTRFS_NAME_LEN limit of 255, so a crafted image with namelen=4096 drives read_extent_buffer/memcpy past a 255-byte destination buffer, causing a page fault and kernel panic (the crash trace shows a supervisor write fault, i.e. out-of-bounds write into the fixed name buffer). The input CVSS is 3.1 7.8 AV:L/AC:L/PR:L/C:H/I:H/A:H, but this rating appears overstated: the vulnerability is only reachable by getting the victim to mount/parse an attacker-crafted btrfs filesystem (or reach the export/open_by_handle path against one), so complexity is realistically higher (AC:H) and the demonstrated impact is a crash rather than confirmed confidentiality/integrity compromise - the vendor Tags themselves label this 'Denial Of Service'. There is NO EPSS score, NO CISA KEV listing, and NO public exploit identified at time of analysis, so real-world exploitation pressure is low; this is a defense-in-depth hardening fix (add namelen validation like ROOT_REF already has) rather than a widely-weaponizable remote bug. Note the conflict: CVSS claims C:H/I:H/A:H while the crash evidence and DoS tag point to an availability-dominant impact - treat the full triad as unverified.
Exploit ScenarioDerived

An attacker crafts a malicious btrfs image with an INODE_REF whose namelen field (4096) exceeds the 255-byte name buffer, then induces a victim to mount it - e.g. via a USB drive, a container/loopback image, or an automounted removable device. When the kernel walks the inode ref (notably through the exportfs/get_name path), it copies 4096 bytes into a 255-byte buffer, triggering an out-of-bounds access and a kernel panic (DoS). No public exploit code is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Mounting a crafted btrfs filesystem image on an unpatched Linux kernel can overflow a fixed 255-byte name buffer while processing a malformed INODE_REF item, producing an out-of-bounds memcpy/page fault and a kernel panic (denial of service, with memory-safety implications). The assessed vector is local, high-complexity, PR:L (authenticated/low-privileged local access) - an attacker must be able to supply the malicious image and get it parsed, for example via mount, an unprivileged user-namespace/loopback mount, or the NFS/open_by_handle export path (exportfs_decode_fh_raw → reconnect_path → btrfs_get_name) shown in the crash trace. Only systems that use btrfs (and particularly those exporting btrfs filesystems over NFS) are affected; there is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis. Patches are available in the vendor stable releases Linux 6.12.111, 6.18.53, and 7.2 (EUVD-2026-86201).

RemediationAI

Apply the vendor fixes: update to Linux 6.12.111, 6.18.53, or 7.2 (or a later stable/mainline release containing commits 3dc22abc21f5892406c09202fa2627196cc96967, 8f75c19892263bc0555fba922aefe103e841e86d, and eeddee090b834a7d4b6a8214d2e3739e64c7a338, e.g. https://git.kernel.org/stable/c/eeddee090b834a7d4b6a8214d2e3739e64c7a338); these patches add INODE_REF namelen validation so malformed images are rejected at read time with a "corrupt leaf" error rather than reaching memcpy. Because a patched kernel still mounts a *crafted* image's valid portions, the strongest compensating control is to never mount or parse btrfs images from untrusted sources - this costs operational flexibility for CI/test pipelines that mount user-supplied images. Where mount privileges cannot be fully trusted, block unprivileged user namespaces and loop-device mounts (set kernel.unprivileged_userns_clone=0 and/or user.max_user_namespaces=0, and restrict /dev/loop* to root via mode/cgroup permissions); these settings break rootless container runtimes (Podman, rootless Docker) and unprivileged sandboxing, so scope them deliberately. If btrfs is exported over NFS or exposed through file-handle-based tooling (open_by_handle), restrict or disable that export on affected hosts, since exportfs_decode_fh_raw → reconnect_path → btrfs_get_name is the confirmed crash path - trade-off: this breaks NFS re-export, filehandle-based backup/indexing software, and some cluster filesystem clients until the kernel is patched. Note that mounting read-only is not an effective workaround here, because the corrupt INODE_REF is consumed during metadata reads regardless of write protection.

Affected VersionsENISA

Linux 0 <6.12.111
Linux 0 <6.18.53
Linux patch: 6.18.53
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <eeddee090b834a7d4b6a8214d2e3739e64c7a338
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8f75c19892263bc0555fba922aefe103e841e86d
Linux patch: 7.2
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <3dc22abc21f5892406c09202fa2627196cc96967
Linux patch: 6.12.111

Affected Packages

euvd linux fix: 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

btrfs stores directory-entry linkage as INODE_REF items whose payload consists of a transaction index, a namelen field, and the name bytes; names are capped by BTRFS_NAME_LEN at 255 bytes. The kernel's btrfs tree-checker runs on read (when extent buffers are read/validated) and is supposed to reject structurally corrupt metadata before it reaches consumers. In this case the checker verified that the item size was consistent with the reported namelen (the crafted item has itemsize 4106 with namelen 4096) but never enforced the upper bound of 255 on namelen itself, so a namelen of 4096 was accepted. When the item is later consumed, btrfs_get_name copies the name through read_extent_buffer into a destination buffer sized for the normal name limit, and the memcpy runs past that buffer - the crash log records a supervisor write page fault in memcpy, i.e. a kernel out-of-bounds write, not merely an over-read (input CWE is listed as N/A, but the class is improper validation of a length field leading to out-of-bounds memory access). The demonstrated trigger path is the exportfs/file-handle path (exportfs_decode_fh_raw → reconnect_path → btrfs_get_name), which is reachable through NFS export of a btrfs filesystem or the open_by_handle() syscall, though direct mount of a crafted image is the simplest delivery vector. The fix adds namelen range validation for INODE_REF mirroring the existing ROOT_REF checks, so malformed images are rejected gracefully with messages such as "invalid inode ref name length, has 4096 expect [1, 255]". CPE records identify the affected component as the Linux kernel (cpe:2.3:a:linux:linux).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.8 MEDIUM

Local, gated on mounting an attacker-crafted btrfs image (AC:H, PR:L); demonstrated impact is a kernel panic (A:H) with only possible limited memory disclosure/corruption (C:L/I:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 6.0 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
7.8 (HIGH)
Patch available
Sep 24, 2026 - 17:03 EUVD
CVE Published
Sep 24, 2026 - 16:02 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 24, 2026 - 16:02 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

btrfs: tree-checker: validate INODE_REF's namelen

[BUG] A crafted btrfs image can trigger the following crash:

BUG: unable to handle page fault for address: ffffd1dc42884000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-custom+ #383 PREEMPT(full) 46af0a92938a63be7132e0dfd71e62327c51d5c2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:memcpy+0xc/0x10 Call Trace: <TASK> read_extent_buffer+0xe4/0x100 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] btrfs_get_name+0x15e/0x1e0 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] reconnect_path+0x165/0x390 exportfs_decode_fh_raw+0x337/0x400 ? drop_caches_sysctl_handler+0xb0/0xb0 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:memcpy+0xc/0x10 Kernel panic - not syncing: Fatal exception

[CAUSE] TThe crafted image has the following corrupted INODE_REF item:

item 9 key (258 INODE_REF 257) itemoff 11544 itemsize 4106 index 2 namelen 4096 name: d\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000

The itemsize matches the namelen, but the namelen is 4096, way larger than normal name length limit (BTRFS_NAME_LEN, 255).

Meanwhile the memory of the @name is only 255 byte sized, this will cause out-of-boundary access, and cause the above crash.

[FIX] Add extra namelen verification for INODE_REF, just like what we have done in ROOT_REF checks.

Now the crafted image can be rejected gracefully:

BTRFS critical (device dm-2): corrupt leaf: root=5 block=30572544 slot=14 ino=259, invalid inode ref name length, has 4096 expect [1, 255] BTRFS error (device dm-2): read time tree block corruption detected on logical 30572544 mirror 2

[ Rebase, add a Link: tag, add an simple cause analyze ]

Executive ViewAI

Why It Matters

A memory-safety flaw in the Linux kernel's btrfs filesystem (CVE-2026-93813, CVSS 7.8) enables an authenticated local attacker to crash affected servers by mounting a crafted image, causing denial of service-particularly for systems exporting btrfs volumes over NFS. Leadership should prioritize remediation because unpatched btrfs workloads risk unplanned downtime; no public exploit identified at time of analysis.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 98% exploitable
Prevalence
Ubiquitous
Linux kernel is ubiquitous; btrfs crafted-image mount path is a narrower subset
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93813 ADVISORY https://vuldb.com/vuln/409540 REF https://git.kernel.org/stable/c/3dc22abc21f5892406c09202fa2627196cc96967 REF https://git.kernel.org/stable/c/4cb41f07685f88ec724a375883bb0c731db8f6eb REF https://git.kernel.org/stable/c/509d6a4d889e425f305461d8323a7b39ca6c121c REF https://git.kernel.org/stable/c/60078a3e25c09d9d8fba828b0d81bb33e449a1b2 REF https://git.kernel.org/stable/c/8f75c19892263bc0555fba922aefe103e841e86d REF https://git.kernel.org/stable/c/eeddee090b834a7d4b6a8214d2e3739e64c7a338

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy