CVE-2026-80631

Received Received - Intake

Buffer Overflow in Linux Kernel Btrfs LZO Compression

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg_len passes the cbuf check but runs past the end of the bio, so copy_compressed_segment() walks off the last folio: get_current_folio() then returns the NULL folio from bio_next_folio(), and with CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults. BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs/btrfs/lzo.c:383) Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29 Workqueue: btrfs-endio simple_end_io_work kasan_report (mm/kasan/report.c:590) lzo_decompress_bio (fs/btrfs/lzo.c:383) end_bbio_compressed_read (fs/btrfs/compression.c:1065) btrfs_bio_end_io (fs/btrfs/bio.c:135) btrfs_check_read_bio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285) simple_end_io_work process_one_work worker_thread Reject any segment whose payload would extend beyond compressed_len before copying it, treating it as corruption like the other on-disk validation failures in this function.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80631

EUVD

EUVD-2026-67507

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a null-pointer dereference vulnerability in the Linux kernel's Btrfs filesystem. It occurs during LZO decompression when processing crafted extent data. The function lzo_decompress_bio() fails to validate segment lengths against the total compressed input size, allowing a segment to overflow the input buffer. This leads to accessing a NULL folio and a kernel crash.

Detection Guidance

This vulnerability affects the Linux kernel's Btrfs filesystem with LZO compression. Detection requires checking kernel logs for KASAN null-ptr-deref errors in lzo_decompress_bio or related Btrfs compression functions. Monitor system logs for crashes or kernel oopses during Btrfs operations.

Impact Analysis

This vulnerability can cause system crashes or kernel panics when processing malicious Btrfs filesystem data. It may lead to denial-of-service conditions if an attacker crafts specific filesystem structures. Systems using Btrfs with LZO compression are affected.

Compliance Impact

This vulnerability is a null-pointer dereference in the Linux kernel's Btrfs filesystem LZO compression handling. It does not directly relate to data privacy, access controls, or audit logging required by GDPR or HIPAA. The issue could cause system crashes but does not inherently violate compliance standards unless it leads to unauthorized data access or integrity failures.

Mitigation Strategies

Apply the latest Linux kernel patches that fix this issue. Disable LZO compression for Btrfs filesystems if possible, or avoid using untrusted filesystems. Monitor for suspicious Btrfs-related crashes or filesystem corruption.

Hi! I’m here to help you understand CVE-2026-80631. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70