CVE-2026-97415: btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF
In the Linux kernel, the following vulnerability has been resolved:
btrfs: tree-checker: validate names in ROOTREF and ROOTBACKREF
ROOTREF and ROOTBACKREF items contain a struct btrfsrootref followed by the subvolume name. Several readers assume that this layout is already valid and then use the on-disk name length directly. A corrupted item can therefore make those readers address bytes outside the item, and BTRFSIOCGETSUBVOLINFO can copy too many bytes into its fixed-size UAPI name buffer.
Validate ROOTREF and ROOTBACKREF items in tree-checker before any reader uses them. Reject records that do not contain a non-empty name, whose namelen does not exactly describe the remaining item payload, or whose name exceeds BTRFSNAMELEN.
For BTRFSIOCGETSUBVOLINFO, copy only the validated on-disk namelen instead of deriving the copy length from the item size. The ioctl result is zeroed when allocated. That leaves the existing trailing zero byte untouched.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the BTRFS tree-checker, validate ROOT_REF and ROOT_BACKREF items before any reader uses them: reject records with an empty name, a name exceeding BTRFS_NAME_LEN, or a name_len that does not exactly describe the remaining item payload.
- Compensating control
For BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len into the fixed-size name buffer rather than deriving the copy length from the item size, leaving the existing trailing zero byte untouched.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker would need to cause Btrfs to process a corrupted ROOT_REF or ROOT_BACKREF item whose embedded subvolume-name length is invalid. The affected paths include readers of these metadata items and BTRFS_IOC_GET_SUBVOL_INFO.
What is the practical impact of malformed metadata?
A malformed item can cause readers to address bytes outside the item. In the BTRFS_IOC_GET_SUBVOL_INFO path, it can also cause more bytes than intended to be copied into the ioctl's fixed-size UAPI name buffer.
How does the fix identify invalid records?
The tree-checker rejects ROOT_REF and ROOT_BACKREF records with an empty name, a name_len that does not exactly match the remaining item payload, or a name longer than BTRFS_NAME_LEN. The ioctl path copies the validated on-disk name_len rather than deriving its copy length from the item size.