Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODE_REF's namelen [BUG] A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-custom+ #383 PREEMPT(full) 46af0a92938a63be7132e0dfd71e62327c51d5c2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:memcpy+0xc/0x10 Call Trace: <TASK> read_extent_buffer+0xe4/0x100 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] btrfs_get_name+0x15e/0x1e0 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] reconnect_path+0x165/0x390 exportfs_decode_fh_raw+0x337/0x400 ? drop_caches_sysctl_handler+0xb0/0xb0 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:memcpy+0xc/0x10 Kernel panic - not syncing: Fatal exception [CAUSE] TThe crafted image has the following corrupted INODE_REF item: item 9 key (258 INODE_REF 257) itemoff 11544 itemsize 4106 index 2 namelen 4096 name: d\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000 The itemsize matches the namelen, but the namelen is 4096, way larger than normal name length limit (BTRFS_NAME_LEN, 255). Meanwhile the memory of the @name is only 255 byte sized, this will cause out-of-boundary access, and cause the above crash. [FIX] Add extra namelen verification for INODE_REF, just like what we have done in ROOT_REF checks. Now the crafted image can be rejected gracefully: BTRFS critical (device dm-2): corrupt leaf: root=5 block=30572544 slot=14 ino=259, invalid inode ref name length, has 4096 expect [1, 255] BTRFS error (device dm-2): read time tree block corruption detected on logical 30572544 mirror 2 [ Rebase, add a Link: tag, add an simple cause analyze ]

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-24T17:17:14.763Z",
  "pubdate": "2026-09-24T17:17:14.763Z",
  "executiveSummary": "The Linux kernel Btrfs file system driver contains a memory safety vulnerability stemming from insufficient validation of filesystem metadata.\nThe vulnerability is identified as an out-of-bounds access issue triggered by an improperly crafted INODE_REF item containing a name length exceeding the defined architectural limit.\nAn attacker capable of providing a malicious or corrupted Btrfs filesystem image can exploit this flaw to induce a kernel-level memory corruption.\nThe impact of this vulnerability is a kernel panic, leading to a denial-of-service (DoS) state. In scenarios where a crafted image is mounted, the kernel will attempt to access memory beyond the allocated buffer, resulting in a system crash.\nThis vulnerability highlights a critical failure in the Btrfs tree-checker module's input sanitization routines for filesystem objects.\nRisk is primarily concentrated on environments where untrusted storage media or filesystem images are mounted, such as systems processing external drive images or virtualized storage containers.",
  "technicalDetails": "The vulnerability resides within the Btrfs tree-checker mechanism, which is responsible for verifying the integrity of filesystem objects before they are processed by the VFS layer or other internal filesystem components.\nThe core issue is a missing length validation check for the 'namelen' field within INODE_REF items stored in the Btrfs metadata tree. The Btrfs protocol defines a maximum name length constant, BTRFS_NAME_LEN, which is set to 255 bytes.\nWhen the Btrfs driver parses a corrupted image, it reads an INODE_REF item where the 'namelen' field is set to 4096. While the 'itemsize' field matches this value, the internal buffer allocated to store this metadata during name resolution operations, such as those performed in 'btrfs_get_name' or 'reconnect_path', is only 255 bytes.\nThe exploitation flow begins when the kernel processes an INODE_REF item. During the execution of 'reconnect_path' (often involved in exportfs/NFS operations), the kernel invokes 'btrfs_get_name' to resolve an inode path. Because the tree-checker fails to validate that 'namelen' conforms to the BTRFS_NAME_LEN limit, the memory copy operation (specifically 'memcpy') blindly attempts to move 4096 bytes of data into a fixed-size 255-byte buffer.\nThis direct out-of-bounds write leads to a page fault in kernel mode, as the operation attempts to access memory addresses outside the valid bounds of the kernel stack or heap-allocated memory associated with the inode name string. The kernel triggers a 'BUG' or 'Kernel panic' as a result of a supervisor write access violation to a non-present or protected page.\nSince the crash occurs during the metadata traversal of the filesystem, the exploitation process does not require network access, only the ability to mount the malicious image. The attacker must possess the privileges required to perform a mount operation, which typically implies root or equivalent administrative access in the context of the filesystem mounting system call. The lack of proper bounds checking effectively turns the Btrfs metadata parser into a vector for controlled (though in this case, destructive) memory corruption."
}