Look up another CVE · open CVE-2026-74723 in the interactive tracker

CVE-2026-74723

btrfs: lzo: reject inline extents without valid headers

9.8 EPSS 0.6% AV:N

Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem fs/btrfs. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-74723 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	vulnerable	6.1.190-1	No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication.
Debian 13trixie	vulnerable	6.12.113-1	No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication.
Debian 14forky	fixed	7.1.9-1	Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.9-1	Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

[BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in lzo_decompress+0x57d/0x700 Read of size 4 at addr ffff888006f2e644 by task btrfs_lzo_inlin/77 Call Trace: <TASK> dump_stack_lvl+0x5b/0x70 print_report+0xd1/0x610 kasan_report+0xe0/0x110 __asan_report_load_n_noabort+0x13/0x20 lzo_decompress+0x57d/0x700 btrfs_decompress+0x140/0x1c0 uncompress_inline+0x147/0x1b0 btrfs_get_extent+0xb23/0x10a0 btrfs_do_readpage.constprop.0+0x538/0x1ac0 btrfs_readahead+0x32f/0x5f0 read_pages+0x16f/0x850 page_cache_ra_unbounded+0x296/0x490 do_page_cache_ra+0xd9/0x130 page_cache_sync_ra+0x3ee/0x6f0 filemap_get_pages+0x306/0x15c0 filemap_read+0x329/0xd00 btrfs_file_read_iter+0x1f8/0x2b0 vfs_read+0x4ef/0x720 ksys_read+0xf8/0x1d0 __x64_sys_read+0x71/0xb0 x64_sys_call+0x1ab0/0x1b70 do_syscall_64+0x61/0x470 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> [CAUSE] For an inline lzo compressed file extent, there should always be one lzo header, recording the total length of the compressed data, followed by one segment header, recording the compressed lzo payload. But if a crafted inline lzo compressed file extent contains only an lzo header, without the segment header or payload, lzo_decompress() will still try to read the segment header, causing a read beyond the item boundary. Furthermore if the inline lzo compressed file extent is the first item of the leaf, it will be at the extent buffer boundary. The above out-of-boundary read will go beyond the extent buffer boundary, triggering the above KASAN report. [FIX] Validate the total length of the inlined lzo compressed file extent, to make sure there is at least one LZO header and one segment header, and a non-zero payload. [ Rework the commit message to remove slop ]

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

fs/btrfs/lzo.c

What this is: BTRFS FILE SYSTEMMAINTAINERS section matched on fs/btrfs/ · linux-btrfs@vger.kernel.org · Maintained
Kernel module: btrfs

Check it on the machine

grep -w CONFIG_BTRFS_FS /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w btrfs

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switch: CONFIG_BTRFS_FS

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-08-22 (2 months ago)source
CVSS: 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.65%, higher than 50.1% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: fs/btrfs

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.38	6.18.57	056876c9db1e
2.6.38	7.1.9	fc50b475ad27
2.6.38	7.2	0fa78ef637de

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: On storage servers exporting a btrfs volume via nfsd or ksmbd, remote client read I/O reaches uncompress_inline→lzo_decompress on the server kernel; crafted inline LZO extents in a mounted image are parsed without local syscall access.
AC:LAttack complexity, low: A btrfs image with an inline LZO extent containing only the 4-byte total header deterministically drives get_unaligned_le32 past the kmalloc copy in lzo_decompress(); tree-checker skips compressed-inline validation so mount succeeds and a normal read triggers the slab OOB.
PR:NPrivileges required, none: Triggering requires only read access to exported btrfs content (nfsd/ksmbd read, loop-mount with CAP_SYS_ADMIN in a user namespace, or udisks-assisted mount); creating the malformed metadata needs offline image crafting, not init-namespace root on the victim.
UI:NUser interaction, none: Exploitation is the attacker's own read against an already-mounted/exported btrfs volume containing the crafted extent; no separate victim must mount media, click a dialog, or perform other interaction beyond the attacker's read/open.
S:UScope, unchanged: The slab out-of-bounds read and any resulting kernel memory misuse stay within the host kernel security domain; no VM escape, IOMMU bypass, or sandbox boundary is crossed.
C:HConfidentiality impact, high: get_unaligned_le32 reads up to four bytes past the kmalloc buffer holding the inline extent, leaking adjacent slab contents that can include kernel pointers and enable further kernel memory disclosure.
I:HIntegrity impact, high: Slab-out-of-bounds access is kernel memory corruption; adjacent kmalloc objects can be groomed and the disclosed pointers chained into arbitrary write or control-flow hijack primitives during repeated reads.
A:HAvailability impact, high: KASAN reports slab-out-of-bounds in lzo_decompress on read; the invalid access can fault into adjacent slab objects and oops the kernel, and repeated reads can destabilize or hang the host.