btrfs RootRef Overflow

Vulnerability analysis

A corrupted btrfs filesystem image can contain subvolume reference items whose stored name length does not match the actual item payload or exceeds the maximum allowed length. The kernel previously trusted this on-disk length without validation, causing internal readers to access memory beyond the item boundary and, most critically, causing the get-subvolume-info ioctl to copy more bytes than a fixed-size kernel buffer can hold — a heap buffer overflow with attacker-influenced data. The fix adds validation in the btrfs tree-checker that rejects any reference item whose name length is empty, inconsistent with the item size, or exceeds the maximum, and it changes the ioctl to copy only the validated name length rather than deriving the copy size from the total item size. The vulnerable path is reached by mounting a crafted btrfs image, which requires either root privileges to mount manually or physical access to insert removable media that triggers automount; once mounted, any local user can invoke the ioctl.