Vulnerability in Linux Kernel Affects btrfs Compression Handling

CVE-2026-74723

What is CVE-2026-74723?

In the Linux kernel, a vulnerability has been identified in the btrfs file system related to the handling of inline lzo compressed file extents. If a specially crafted btrfs image is processed, it can trigger a KASAN report due to an out-of-bounds read. This occurs when the inline lzo compressed extent lacks the necessary segment header and payload, which leads the lzo_decompress function to attempt to read beyond the allocated boundaries. The issue may result in unpredictable behavior or crashes if the extent is positioned at a buffer boundary, thus posing a significant risk. To mitigate this vulnerability, it is crucial to validate the integrity of the inline lzo compressed file extent by ensuring that it contains a valid lzo header and segment header, along with a non-zero payload.

References