Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg_len passes the cbuf check but runs past the end of the bio, so copy_compressed_segment() walks off the last folio: get_current_folio() then returns the NULL folio from bio_next_folio(), and with CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults. BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs/btrfs/lzo.c:383) Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29 Workqueue: btrfs-endio simple_end_io_work kasan_report (mm/kasan/report.c:590) lzo_decompress_bio (fs/btrfs/lzo.c:383) end_bbio_compressed_read (fs/btrfs/compression.c:1065) btrfs_bio_end_io (fs/btrfs/bio.c:135) btrfs_check_read_bio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285) simple_end_io_work process_one_work worker_thread Reject any segment whose payload would extend beyond compressed_len before copying it, treating it as corruption like the other on-disk validation failures in this function.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T08:16:48.010Z",
  "pubdate": "2026-08-28T08:16:48.010Z",
  "executiveSummary": "A null-pointer dereference vulnerability exists in the Linux kernel's Btrfs file system LZO decompression implementation. The flaw occurs due to insufficient validation of compressed segment lengths relative to the total compressed input size contained within a bio structure.\nAn attacker capable of crafting a malicious Btrfs file system image can trigger this vulnerability during read operations. By manipulating the on-disk extent data, an attacker can force the kernel to attempt to access memory beyond the valid bounds of the bio's folio list.\nThis vulnerability is classified as an out-of-bounds access leading to a null-pointer dereference, which results in a kernel panic and a subsequent denial-of-service (DoS) condition. The impact is critical to system availability. Successful exploitation does not inherently require high privileges on the host, provided the attacker can force the kernel to mount and read the malformed compressed data.\nThe root cause is a failure to properly sanitize segment metadata against the actual allocated buffer size, allowing the `lzo_decompress_bio` function to walk past the terminal folio.",
  "technicalDetails": "The vulnerability resides in the `lzo_decompress_bio` function within `fs/btrfs/lzo.c`. The Btrfs file system uses LZO compression for stored data, which is processed in segments during read operations. The decompression routine relies on a workspace buffer (cbuf) to stage data before final decompression.\nThe root cause of the vulnerability is an incomplete validation logic during the processing of compressed segments. While the code performs a check ensuring that the segment length (`seg_len`) does not exceed the cbuf size, it fails to perform a bounds check against the actual `compressed_len`, which represents the total bytes available within the bio structure's folios.\nThe attack flow begins when the kernel attempts to process a corrupted or maliciously crafted compressed extent. An attacker provides a file with a specifically crafted metadata header where the segment length is defined such that it satisfies the internal cbuf size constraint but exceeds the remaining length of the bio input buffer.\nWhen `copy_compressed_segment()` is invoked, it proceeds to copy the segment data. Because the length check is insufficient, the pointer advancement logic walks past the last valid folio in the bio. Subsequently, the function calls `get_current_folio()`, which internally invokes `bio_next_folio()`. Since the pointer has advanced beyond the buffer limits, `bio_next_folio()` returns a NULL pointer.\nIn environments where `CONFIG_BTRFS_ASSERT` is disabled (the standard configuration for production kernels), the kernel subsequently passes this NULL pointer to `folio_size(NULL)`. This triggers an immediate KASAN-detected null-pointer dereference, resulting in an unrecoverable kernel oops and system crash.\nThe vulnerability allows for a denial-of-service attack against any system that parses untrusted Btrfs file system images. Since the error occurs in `btrfs-endio` (the end-of-I/O handler), the crash is triggered asynchronously during background read operations, making it difficult for standard user-mode applications to intercept. No specific authentication or high-level privilege is required other than the ability to influence file system mounting or data access, which is characteristic of local exploitation vectors involving removable media or malicious image file processing."
}