Cloudanix VulnDB

CVE-2026-80631

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how Linux handles certain compressed files on Btrfs storage can cause the system to crash when reading specially made data.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

lzo_decompress_bio fails to validate each compressed segment length against the total compressed_len of the bio, allowing a crafted extent to cause copy_compressed_segment to dereference a NULL folio and trigger a null-ptr-deref fault during decompression.

Why it matters to the business

Systems using Btrfs with LZO compression can experience kernel crashes and denial of service when reading specially crafted on-disk data, leading to unplanned downtime and potential data access disruption on affected Linux hosts.

How an attack unfolds

An attacker supplies a malicious Btrfs filesystem image or file containing a compressed extent whose segment length passes the workspace check but exceeds the bio's total compressed data; when the kernel decompresses the extent during a read operation, the missing bounds check causes a NULL folio dereference and crash.

How to fix it

Upgrade the Linux kernel to a version containing the upstream fix that rejects segments whose payload would exceed compressed_len; rebuild and reboot with the patched kernel; avoid mounting untrusted Btrfs volumes with LZO compression until updated.

How to confirm the fix worked

Confirm the running kernel contains the patch by checking the btrfs/lzo.c source or kernel version string; attempt to reproduce the crash with a crafted test image and verify the segment-length check now rejects the input as corruption.

Typical attack path

  1. Craft a Btrfs extent with an oversized LZO segment that evades seg_len validation
  2. Place the malicious extent on storage reachable by the target system
  3. Trigger a read of the affected file or metadata via normal I/O or mount
  4. Kernel worker thread executes lzo_decompress_bio and faults on NULL folio access

How to detect it

Search kernel logs and dmesg for KASAN reports or BUG entries referencing lzo_decompress_bio, null-ptr-deref, and btrfs-endio workqueues; inspect recent file reads or mounts of Btrfs volumes preceding any such crash.

  • BUG: KASAN: null-ptr-deref in lzo_decompress_bio
  • lzo_decompress_bio (fs/btrfs/lzo.c:383)
  • Workqueue: btrfs-endio simple_end_io_work

What your security team should do

  • Prioritize kernel updates on all systems using Btrfs with LZO compression
  • Restrict mounting of untrusted or external Btrfs filesystems until patched
  • Monitor kernel logs for btrfs and LZO decompression errors
  • Consider disabling LZO compression on Btrfs volumes where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg_len passes the cbuf check but runs past the end of the bio, so copy_compressed_segment() walks off the last folio: get_current_folio() then returns the NULL folio from bio_next_folio(), and with CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults. BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs/btrfs/lzo.c:383) Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29 Workqueue: btrfs-endio simple_end_io_work kasan_report (mm/kasan/report.c:590) lzo_decompress_bio (fs/btrfs/lzo.c:383) end_bbio_compressed_read (fs/btrfs/compression.c:1065) btrfs_bio_end_io (fs/btrfs/bio.c:135) btrfs_check_read_bio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285) simple_end_io_work process_one_work worker_thread Reject any segment whose payload would extend beyond compressed_len before copying it, treating it as corruption like the other on-disk validation failures in this function.

Affected packages

Ecosystem Package Introduced Fixed