Look up another CVE · open CVE-2026-93813 in the interactive tracker
CVE-2026-93813
btrfs: tree-checker: validate INODE_REF's namelen
Published 2026-09-24 (24 days ago) by the Linux kernel CNA. Subsystem fs/btrfs. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-93813 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
[BUG] A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-custom+ #383 PREEMPT(full) 46af0a92938a63be7132e0dfd71e62327c51d5c2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:memcpy+0xc/0x10 Call Trace: <TASK> read_extent_buffer+0xe4/0x100 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] btrfs_get_name+0x15e/0x1e0 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] reconnect_path+0x165/0x390 exportfs_decode_fh_raw+0x337/0x400 ? drop_caches_sysctl_handler+0xb0/0xb0 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:memcpy+0xc/0x10 Kernel panic - not syncing: Fatal exception [CAUSE] TThe crafted image has the following corrupted INODE_REF item: item 9 key (258 INODE_REF 257) itemoff 11544 itemsize 4106 index 2 namelen 4096 name: d\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000 The itemsize matches the namelen, but the namelen is 4096, way larger than normal name length limit (BTRFS_NAME_LEN, 255). Meanwhile the memory of the @name is only 255 byte sized, this will cause out-of-boundary access, and cause the above crash. [FIX] Add extra namelen verification for INODE_REF, just like what we have done in ROOT_REF checks. Now the crafted image can be rejected gracefully: BTRFS critical (device dm-2): corrupt leaf: root=5 block=30572544 slot=14 ino=259, invalid inode ref name length, has 4096 expect [1, 255] BTRFS error (device dm-2): read time tree block corruption detected on logical 30572544 mirror 2 [ Rebase, add a Link: tag, add an simple cause analyze ]
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/btrfs/tree-checker.c
- What this is
- BTRFS FILE SYSTEMMAINTAINERS section matched on fs/btrfs/ · linux-btrfs@vger.kernel.org · Maintained
- Kernel module
- btrfs
Check it on the machine
grep -w CONFIG_BTRFS_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w btrfsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_BTRFS_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-24 (24 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/btrfs
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.37 | 5.15.222 | 60078a3e25c0 |
| 2.6.37 | 6.1.189 | 509d6a4d889e |
| 2.6.37 | 6.6.158 | 4cb41f07685f |
| 2.6.37 | 6.12.111 | eeddee090b83 |
| 2.6.37 | 6.18.53 | 8f75c1989226 |
| 2.6.37 | 7.2 | 3dc22abc21f5 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- check_inode_ref() failed to cap INODE_REF name_len, so a crafted leaf with name_len 4096 is accepted. Those bytes come from the mounted image, not a protocol field. The overflow is open_by_handle_at() → do_handle_to_path() → exportfs_decode_fh_raw() → reconnect_path() → btrfs_get_name(); btrfs_fid has only objectid/gen, so an NFS handle does not carry the bad namelen.
- AC:LAttack complexity, low
- The attacker writes an INODE_REF whose name_len exceeds BTRFS_NAME_LEN (255) but fits the item (PoC: 4096/4106), which the old check_inode_ref() allowed. Mounting that image and calling open_by_handle_at() on a directory filehandle for that inode makes reconnect_path() call btrfs_get_name() every time; no race or uninducible device failure is required.
- PR:LPrivileges required, low
- btrfs_fs_type lacks FS_USERNS_MOUNT, so mount_capable() needs init-ns CAP_SYS_ADMIN, but a local user can mount the image via udisks2/polkit. The trigger is open_by_handle_at(): may_decode_fh() admits ns_capable(current_user_ns(), CAP_DAC_READ_SEARCH) with capable_wrt_mount() and O_DIRECTORY, so userns root on that mount is enough.
- UI:NUser interaction, none
- The attacker authors the INODE_REF, mounts the image (udisks/loop), and calls open_by_handle_at() so reconnect_path() runs btrfs_get_name() on that inode. That is their own action against data they already control; no second user must open a file or confirm a dialog.
- S:UScope, unchanged
- btrfs_get_name()'s overflow of exportfs_decode_fh_raw()'s nbuf corrupts the host kernel stack only. It does not cross a KVM/Xen guest-host, IOMMU/DMA, or other security-authority boundary.
- C:HConfidentiality impact, high
- read_extent_buffer() in btrfs_get_name() memcpy's the attacker-chosen INODE_REF name (PoC namelen 4096) into exportfs_decode_fh_raw()'s nbuf[NAME_MAX+1] (256 bytes). That stack overflow overwrites saved frames and is kernel memory corruption usable for arbitrary disclosure.
- I:HIntegrity impact, high
- The same unbounded copy, plus name[name_len]='\0' at offset 4096, is an attacker-controlled out-of-bounds write into kernel stack in exportfs_decode_fh_raw(). Chosen namelen/name bytes enable return-address overwrite and control-flow hijack, not a bounded metadata tweak.
- A:HAvailability impact, high
- The reporter's PoC faults in memcpy() from read_extent_buffer() called by btrfs_get_name() (supervisor write to an unmapped address) and panics. Any name_len that runs nbuf off the mapped stack oopses the host.