UBUNTU-CVE-2026-80631: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzodecompressbio() validates each on-disk segment length seglen only against the workspace cbuf size, not against the compressed input size (compressedlen, the total folio bytes of the bio). A crafted extent can carry a segment whose seglen passes the cbuf check but runs past the end of the bio, so copycompressedsegment() walks off the last folio: getcurrentfolio() then returns the NULL folio from bionextfolio(), and with CONFIGBTRFSASSERT disabled (default) foliosize(NULL) faults. BUG: KASAN: null-ptr-deref in lzodecompressbio (fs/btrfs/lzo.c:383) Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29 Workqueue: btrfs-endio simpleendiowork kasanreport (mm/kasan/report.c:590) lzodecompressbio (fs/btrfs/lzo.c:383) endbbiocompressedread (fs/btrfs/compression.c:1065) btrfsbioendio (fs/btrfs/bio.c:135) btrfscheckreadbio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285) simpleendiowork processonework workerthread Reject any segment whose payload would extend beyond compressedlen before copying it, treating it as corruption like the other on-disk validation failures in this function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1038.42 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In lzo_decompress_bio(), reject any compressed segment whose payload would extend beyond compressed_len before copying it, treating the segment as corruption like other on-disk validation failures.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the listed Ubuntu kernel packages are exposed when they read Btrfs data containing LZO-compressed extents. The vulnerable path is reached during decompression of on-disk compressed segments.
What does an attacker need to exploit it?
An attacker needs to cause processing of a crafted Btrfs extent with a compressed segment length that extends beyond the available compressed input. The severity vector indicates no privileges are required, low attack complexity, and user interaction is required.
What is the likely impact of successful exploitation?
Processing the malformed segment can make the kernel dereference a NULL folio in the Btrfs end-I/O workqueue, causing a kernel fault. The provided impact vector identifies availability impact as high, with no confidentiality or integrity impact.
Are default kernel configurations affected?
Yes. The fault occurs when CONFIG_BTRFS_ASSERT is disabled, which the vulnerability description identifies as the default configuration.
How can I tell whether this has already occurred?
Look for kernel crash or KASAN reports showing a null-pointer dereference in lzo_decompress_bio, potentially through end_bbio_compressed_read, btrfs_bio_end_io, and btrfs_check_read_bio.