CVE-2026-64567: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64567 Overview

CVE-2026-64567 is an out-of-bounds read vulnerability in the Linux kernel's btrfs filesystem. The flaw resides in the v1 free space cache loader (__load_free_space_cache()), which trusts the num_entries and num_bitmaps fields from the on-disk btrfs_free_space_header without validation. A crafted filesystem with an inflated num_entries value causes io_ctl->index to walk past the end of the pages[] array, producing a slab-out-of-bounds read detected by KASAN.

Critical Impact
A crafted or corrupted btrfs filesystem image can trigger an out-of-bounds read in kernel memory, resulting in a general protection fault and kernel panic when the malformed slot is passed to crc32c().

Affected Products

Linux kernel (btrfs filesystem subsystem)
Distributions shipping affected upstream kernel versions prior to the fix commits
Systems mounting untrusted or user-supplied btrfs volumes

Discovery Timeline

2026-08-05 - CVE-2026-64567 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64567

Vulnerability Analysis

The vulnerability affects the btrfs v1 free space cache load path. When a btrfs filesystem is mounted, __load_free_space_cache() reads num_entries and num_bitmaps from the btrfs_free_space_header structure stored in the tree_root. That header uses a key type of 0, which the btrfs tree-checker does not validate, so neither counter is bounded before use.

The loader iterates num_entries times, calling io_ctl_check_crc() and io_ctl_map_page(). Each call advances io_ctl->index and dereferences io_ctl->pages[io_ctl->index++]. The pages[] array is sized from the cache inode's i_size, not from num_entries, using DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE).

When num_entries exceeds the number of allocated pages, io_ctl->index overruns the array. The out-of-bounds slot is dereferenced as a struct page pointer and passed to crc32c(), converting the bad read into a general protection fault.

Root Cause

The write side enforces bounds by stopping when io_ctl->index >= io_ctl->num_pages inside io_ctl_add_entry() and io_ctl_add_bitmap(). The read side lacks the equivalent check. Combined with the tree-checker's missing case for key type 0, the on-disk counters are trusted implicitly, satisfying the classification of an out-of-bounds read caused by missing input validation.

Attack Vector

An attacker who can supply a btrfs image, for example through a mountable USB device, loopback file, or removable media, sets num_entries in the free space header to a value larger than the cache inode's i_size supports. The leaf checksum is adjusted so the corrupted header passes the tree-checker. On mount, the caching thread invokes load_free_space_cache(), triggering the KASAN-reported slab-out-of-bounds read in io_ctl_check_crc() at fs/btrfs/free-space-cache.c:420 and the subsequent GP fault.

The vulnerability is described in prose only; no public exploit code is referenced. Technical detail is available in the upstream commits, including Kernel Git Commit 5e1b2ca and Kernel Git Commit f9fef13.

Detection Methods for CVE-2026-64567

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds in io_ctl_check_crc at fs/btrfs/free-space-cache.c:420 or line 565.
Kernel general protection faults originating from caching_thread and btrfs_work_helper in the call stack.
Repeated mount failures or filesystem rejection messages from __load_free_space_cache() on untrusted btrfs volumes.

Detection Strategies

Monitor dmesg and /var/log/kern.log for KASAN slab-out-of-bounds reports referencing btrfs free space cache functions.
Audit mount events for btrfs filesystems originating from removable or user-controlled sources.
Alert on kernel oops and GP faults tied to the crc32c path invoked from btrfs caching threads.

Monitoring Recommendations

Enable KASAN in test kernels used for triage of suspect btrfs images before mounting on production hosts.
Ship kernel logs to a centralized SIEM and create rules for btrfs-related BUG, WARN, and KASAN events.
Track kernel version inventory to identify hosts running unpatched btrfs code paths.

How to Mitigate CVE-2026-64567

Immediate Actions Required

Apply the upstream btrfs patches that add the missing bounds check in io_ctl_check_crc() and rebuild or update kernels accordingly.
Restrict mounting of btrfs filesystems from untrusted sources, including removable media and user-supplied images.
Disable automount for removable devices on servers that do not require it.

Patch Information

The fix adds a bounds check inside io_ctl_check_crc(), which is the common convergence point for both the entry loop and the bitmap loop. When num_entries is too large, the load fails cleanly, __load_free_space_cache() drops the cache, and the free space is rebuilt from the extent tree. Refer to the upstream commits: Kernel Git Commit 33878ba, Kernel Git Commit 404a0b9, Kernel Git Commit 5e1b2ca, Kernel Git Commit a2d8d56, and Kernel Git Commit f9fef13.

Workarounds

Mount btrfs volumes with nospace_cache or use the v2 free space tree (space_cache=v2) to avoid the v1 cache load path on affected kernels.
Use udev rules or Polkit policies to prevent non-root users from mounting arbitrary block devices.
Restrict physical and remote access to systems that process externally supplied filesystem images.

bash

# Configuration example: mount btrfs with the v2 free space tree
mount -o space_cache=v2,nospace_cache /dev/sdX /mnt/data

# Persist in /etc/fstab
# UUID=<uuid>  /mnt/data  btrfs  defaults,space_cache=v2  0  0