CVE-2026-74723 Overview
CVE-2026-74723 is an out-of-bounds read vulnerability in the Linux kernel's btrfs filesystem LZO decompression path. A crafted btrfs image containing an inline LZO compressed file extent with only an LZO header, and without a segment header or payload, causes lzo_decompress() to read beyond the item boundary. When the malformed inline extent is the first item of a leaf, the read crosses the extent buffer boundary, triggering a KASAN slab-out-of-bounds report in lzo_decompress+0x57d/0x700. The flaw affects file read paths reached through btrfs_get_extent(), uncompress_inline(), and btrfs_do_readpage(). The upstream fix validates the total length of the inlined LZO compressed extent so that at least one LZO header, one segment header, and a non-zero payload are present.
Critical Impact
Mounting or reading a maliciously crafted btrfs filesystem image can trigger a kernel out-of-bounds read in the LZO decompressor, leading to information disclosure or kernel memory corruption.
Affected Products
- Linux kernel btrfs filesystem with LZO compression support
- Linux kernel versions prior to the fix commits 0fa78ef637de and fc50b475ad27
- Distributions shipping vulnerable stable kernels with btrfs enabled
Discovery Timeline
- 2026-08-22 - CVE-2026-74723 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74723
Vulnerability Analysis
The vulnerability is an out-of-bounds read [CWE-125] in the btrfs LZO inline decompression routine. For an inline LZO compressed file extent, btrfs expects a fixed structure: one LZO header recording the total length of the compressed data, followed by one segment header recording the compressed payload. The decompressor assumes both structures exist and reads the segment header without verifying that the item is large enough to contain it.
When an attacker supplies a crafted image where the inline extent contains only the LZO header, lzo_decompress() reads 4 bytes past the end of the item. If that item is the first entry in the leaf, the read extends beyond the extent buffer allocation, producing the KASAN report slab-out-of-bounds in lzo_decompress+0x57d/0x700. The unvalidated read can leak adjacent slab memory into decompression state or destabilize the kernel.
Root Cause
The root cause is missing input validation on the total length of inlined LZO compressed file extents. The code path in uncompress_inline() did not confirm that the item contained at least one LZO header, one segment header, and a non-zero payload before invoking lzo_decompress(). Attackers control the on-disk item length by crafting the btrfs metadata.
Attack Vector
Exploitation requires that a victim reads a file from a crafted btrfs image. Delivery paths include attaching a malicious block device, mounting a prepared image file, or automatic mount of removable media. On systems that auto-mount user-supplied filesystems, an unprivileged local user can trigger the read. Remote exploitation is limited to environments that accept and mount attacker-controlled filesystem images.
The vulnerability manifests when btrfs_readahead() reaches btrfs_do_readpage(), which calls uncompress_inline() and then lzo_decompress() on the malformed inline extent. See the Linux Kernel Commit Log and Linux Kernel Commit Update for the exact validation logic.
Detection Methods for CVE-2026-74723
Indicators of Compromise
- KASAN reports containing slab-out-of-bounds in lzo_decompress in kernel logs
- Kernel oops or panic traces referencing btrfs_decompress, uncompress_inline, or btrfs_do_readpage
- Unexpected mount events for user-supplied btrfs images on production hosts
Detection Strategies
- Audit dmesg and journalctl -k for KASAN, BUG, or WARN entries in the btrfs call stack
- Monitor mount syscalls where the filesystem type is btrfs and the source is a loop device or removable media
- Alert on kernel crashes involving lzo_decompress on hosts running btrfs
Monitoring Recommendations
- Ship kernel logs to a centralized log store and search for btrfs-related fault signatures
- Track kernel version inventory to identify hosts still running unpatched btrfs code
- Restrict which users can mount filesystems and log all mount operations for review
How to Mitigate CVE-2026-74723
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 0fa78ef637de and fc50b475ad27
- Disable auto-mounting of removable media and user-supplied filesystem images on servers
- Restrict CAP_SYS_ADMIN and mount privileges to trusted administrators
- Reboot hosts after kernel updates to ensure the patched btrfs code is loaded
Patch Information
The fix validates the total length of the inlined LZO compressed file extent before decompression, ensuring that at least one LZO header, one segment header, and a non-zero payload are present. Distribution kernels should be updated to versions that incorporate the referenced stable commits. See the Linux Kernel Commit Log and the Linux Kernel Commit Update for details.
Workarounds
- Avoid mounting untrusted btrfs images, especially those received from external sources
- Where btrfs is not required, use an alternative filesystem for removable media handling
- Use noauto and nosuid mount options and require explicit administrator action for new devices
- Deploy udev rules that block automatic mounting of btrfs on user sessions until kernels are patched
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
