CVE-2026-93813: btrfs: tree-checker: validate INODE_REF's namelen
In the Linux kernel, the following vulnerability has been resolved:
btrfs: tree-checker: validate INODEREF's namelen
[BUG] A crafted btrfs image can trigger the following crash:
BUG: unable to handle page fault for address: ffffd1dc42884000 #PF: supervisor write access in kernel mode #PF: errorcode(0x0002) - not-present page CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-custom+ #383 PREEMPT(full) 46af0a92938a63be7132e0dfd71e62327c51d5c2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:memcpy+0xc/0x10 Call Trace: <TASK> readextentbuffer+0xe4/0x100 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] btrfsgetname+0x15e/0x1e0 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] reconnectpath+0x165/0x390 exportfsdecodefhraw+0x337/0x400 ? dropcachessysctlhandler+0xb0/0xb0 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:memcpy+0xc/0x10 Kernel panic - not syncing: Fatal exception
[CAUSE] TThe crafted image has the following corrupted INODEREF item:
item 9 key (258 INODEREF 257) itemoff 11544 itemsize 4106 index 2 namelen 4096 name: d\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000
The itemsize matches the namelen, but the namelen is 4096, way larger than normal name length limit (BTRFSNAMELEN, 255).
Meanwhile the memory of the @name is only 255 byte sized, this will cause out-of-boundary access, and cause the above crash.
[FIX] Add extra namelen verification for INODEREF, just like what we have done in ROOTREF checks.
Now the crafted image can be rejected gracefully:
BTRFS critical (device dm-2): corrupt leaf: root=5 block=30572544 slot=14 ino=259, invalid inode ref name length, has 4096 expect [1, 255] BTRFS error (device dm-2): read time tree block corruption detected on logical 30572544 mirror 2
[ Rebase, add a Link: tag, add an simple cause analyze ]
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to provide a crafted Btrfs filesystem image containing a corrupted INODE_REF item with an invalid name length. The supplied data does not indicate that remote access alone is sufficient.
What is the practical impact?
Processing the crafted image can cause a kernel page fault in memcpy and result in a kernel panic. This is a denial-of-service condition.
What can be done before an updated kernel is available?
Avoid mounting or otherwise processing untrusted Btrfs filesystem images. The issue is triggered by crafted on-disk Btrfs metadata.
How can administrators recognize a possible occurrence?
The reported failure includes a kernel page fault followed by a panic, with stack frames such as read_extent_buffer, btrfs_get_name, reconnect_path, and exportfs_decode_fh_raw. A corrupted INODE_REF item with an unusually large name length is the associated on-disk condition.