CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers
Published Aug 22, 2026
·Updated
btrfs: lzo: reject inline extents without valid headers
Affected Software
1 affected component
Linux Linux kernel
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (btrfs inline LZO decompression)to a version that resolves this vulnerability.Patch btrfs: lzo: reject inline extents without valid headers
Event History
Aug 22, 2026
CVE Published
via MITRE·03:33 PM
Data Sourced
via MITRE·03:33 PM
DescriptionSeverity
Data Sourced
via NVD·04:16 PM
DescriptionSeverity
Aug 24, 2026
Data Sourced
via Microsoft·08:11 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to control to trigger this issue?
The attacker needs to provide a crafted Btrfs image containing an inline LZO-compressed file extent without a valid LZO header.
2
When is the vulnerable code reached?
The issue is triggered when the system reads the malformed inline LZO-compressed file extent. The reported path reaches lzo_decompress through Btrfs inline-extent decompression during a file read.
3
What is the reported failure mode?
The malformed extent can cause a KASAN-reported slab out-of-bounds read in lzo_decompress.