CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input
In the Linux kernel, the following vulnerability has been resolved:
btrfs: lzo: reject compressed segment that overflows the compressed input
lzodecompressbio() validates each on-disk segment length seglen only against the workspace cbuf size, not against the compressed input size (compressedlen, the total folio bytes of the bio). A crafted extent can carry a segment whose seglen passes the cbuf check but runs past the end of the bio, so copycompressedsegment() walks off the last folio: getcurrentfolio() then returns the NULL folio from bionextfolio(), and with CONFIGBTRFSASSERT disabled (default) foliosize(NULL) faults.
BUG: KASAN: null-ptr-deref in lzodecompressbio (fs/btrfs/lzo.c:383) Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29 Workqueue: btrfs-endio simpleendiowork kasanreport (mm/kasan/report.c:590) lzodecompressbio (fs/btrfs/lzo.c:383) endbbiocompressedread (fs/btrfs/compression.c:1065) btrfsbioendio (fs/btrfs/bio.c:135) btrfscheckreadbio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285) simpleendiowork processonework workerthread
Reject any segment whose payload would extend beyond compressedlen before copying it, treating it as corruption like the other on-disk validation failures in this function.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems that read Btrfs data containing LZO-compressed extents are exposed if an extent contains a crafted compressed segment length. The vulnerable path is in Btrfs LZO decompression during compressed reads.
What does an attacker need to trigger the fault?
An attacker needs to cause the system to read a crafted on-disk extent whose segment length fits the decompression workspace buffer but extends beyond the compressed input carried by the bio. This causes the decompressor to walk past the final folio.
Is the default kernel configuration affected?
Yes. With CONFIG_BTRFS_ASSERT disabled, which the description identifies as the default, the invalid folio reaches folio_size(NULL) and faults.
How might this appear in diagnostics?
The reported failure is a null-pointer dereference in lzo_decompress_bio, reached through end_bbio_compressed_read and Btrfs bio completion work. KASAN may report a read at address 0x0 in lzo_decompress_bio.