CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers
In the Linux kernel, the following vulnerability has been resolved:
btrfs: lzo: reject inline extents without valid headers
[BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent:
BUG: KASAN: slab-out-of-bounds in lzodecompress+0x57d/0x700 Read of size 4 at addr ffff888006f2e644 by task btrfslzoinlin/77
Call Trace: <TASK> dumpstacklvl+0x5b/0x70 printreport+0xd1/0x610 kasanreport+0xe0/0x110 asanreportloadnnoabort+0x13/0x20 lzodecompress+0x57d/0x700 btrfsdecompress+0x140/0x1c0 uncompressinline+0x147/0x1b0 btrfsgetextent+0xb23/0x10a0 btrfsdoreadpage.constprop.0+0x538/0x1ac0 btrfsreadahead+0x32f/0x5f0 readpages+0x16f/0x850 pagecacheraunbounded+0x296/0x490 dopagecachera+0xd9/0x130 pagecachesyncra+0x3ee/0x6f0 filemapgetpages+0x306/0x15c0 filemapread+0x329/0xd00 btrfsfilereaditer+0x1f8/0x2b0 vfsread+0x4ef/0x720 ksysread+0xf8/0x1d0 x64sysread+0x71/0xb0 x64syscall+0x1ab0/0x1b70 dosyscall64+0x61/0x470 entrySYSCALL64afterhwframe+0x4b/0x53 </TASK>
[CAUSE] For an inline lzo compressed file extent, there should always be one lzo header, recording the total length of the compressed data, followed by one segment header, recording the compressed lzo payload.
But if a crafted inline lzo compressed file extent contains only an lzo header, without the segment header or payload, lzodecompress() will still try to read the segment header, causing a read beyond the item boundary.
Furthermore if the inline lzo compressed file extent is the first item of the leaf, it will be at the extent buffer boundary. The above out-of-boundary read will go beyond the extent buffer boundary, triggering the above KASAN report.
[FIX] Validate the total length of the inlined lzo compressed file extent, to make sure there is at least one LZO header and one segment header, and a non-zero payload.
[ Rework the commit message to remove slop ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (btrfs inline LZO decompression)to a version that resolves this vulnerability.Patch btrfs: lzo: reject inline extents without valid headers
Event History
Frequently Asked Questions
What does an attacker need to control to trigger this issue?
The attacker needs to provide a crafted Btrfs image containing an inline LZO-compressed file extent without a valid LZO header.
When is the vulnerable code reached?
The issue is triggered when the system reads the malformed inline LZO-compressed file extent. The reported path reaches lzo_decompress through Btrfs inline-extent decompression during a file read.
What is the reported failure mode?
The malformed extent can cause a KASAN-reported slab out-of-bounds read in lzo_decompress.