HIGH Introduced in 5.15
btrfs LzoSegment Deref
CVE-2026-80631
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg_len passes the cbuf check but runs past the end of the bio, so copy_compressed_segment() walks off the last folio: get_current_folio() then returns the NULL folio from bio_next_folio(), and with CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults. BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs/btrfs/lzo.c:383) Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29 Workqueue: btrfs-endio simple_end_io_work kasan_report (mm/kasan/report.c:590) lzo_decompress_bio (fs/btrfs/lzo.c:383) end_bbio_compressed_read (fs/btrfs/compression.c:1065) btrfs_bio_end_io (fs/btrfs/bio.c:135) btrfs_check_read_bio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285) simple_end_io_work process_one_work worker_thread Reject any segment whose payload would extend beyond compressed_len before copying it, treating it as corruption like the other on-disk validation failures in this function.
02KernelScan AI Analysis
Risk summary
A crafted btrfs filesystem image with a malformed LZO-compressed extent can trigger a NULL pointer dereference in the kernel decompression path, crashing the system. The vulnerability is reached by mounting and reading the crafted image, which requires either physical access to insert removable media or root privileges to perform the mount. Systems that never mount externally-supplied btrfs images are not exposed.
Vulnerability analysis
When the kernel decompresses an LZO-compressed btrfs extent, it checks each on-disk segment length only against the internal workspace buffer size, not against the total size of the compressed input data. A crafted filesystem image can carry a segment whose declared length passes that buffer check but extends past the end of the compressed data, causing the decompression routine to run past the last page of the read and dereference a null pointer, crashing the kernel. The fix adds a bounds check that rejects any segment whose payload would run beyond the compressed input size, treating the condition as filesystem corruption and stopping processing before the segment is copied. The bug is reachable by reading a file from a crafted btrfs image, which requires getting that image mounted—either through physical insertion of removable media that triggers automount, or through a privileged user manually mounting a supplied image.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.1 | 5.15 | 7.1.5 | 1641d058adfb |
| mainline | 5.15 | 7.2 | b0d27d43791b |