CVE-2026-80631 Overview
CVE-2026-80631 is a null pointer dereference vulnerability in the Linux kernel's Btrfs LZO decompression code path. The lzo_decompress_bio() function validates each on-disk segment length only against the workspace cbuf size, not against the total compressed input size (compressed_len). A crafted extent can carry a segment whose seg_len passes the cbuf check but extends past the end of the bio. When copy_compressed_segment() walks off the last folio, get_current_folio() returns a NULL folio from bio_next_folio(), and folio_size(NULL) faults with CONFIG_BTRFS_ASSERT disabled.
Critical Impact
A crafted Btrfs filesystem image with malformed LZO-compressed extents can trigger a kernel null pointer dereference during read operations, resulting in denial of service.
Affected Products
- Linux kernel Btrfs filesystem with LZO compression support
- Kernel builds with CONFIG_BTRFS_ASSERT disabled (default configuration)
- Systems mounting untrusted or crafted Btrfs images
Discovery Timeline
- 2026-08-28 - CVE-2026-80631 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80631
Vulnerability Analysis
The flaw resides in fs/btrfs/lzo.c within the lzo_decompress_bio() function. Btrfs stores LZO-compressed data as a series of segments, each prefixed by a segment length header. During decompression, the kernel iterates through these segments and copies each one from folios attached to the bio into a workspace buffer.
The validation logic checks seg_len only against the workspace cbuf size. It fails to compare the segment payload boundary against compressed_len, which represents the total folio bytes in the bio. A malicious segment length can therefore satisfy the cbuf bounds check while pointing past the last folio in the bio.
When copy_compressed_segment() continues iterating beyond the final folio, bio_next_folio() returns NULL. The subsequent call to folio_size(NULL) dereferences a null pointer inside kernel context, producing a KASAN-reported null-ptr-deref inside the btrfs-endio workqueue worker.
Root Cause
The root cause is incomplete input validation [CWE-20] in the Btrfs LZO decompression path. The bounds check omits comparison against the actual compressed input length, allowing a crafted seg_len to bypass validation and drive the folio iterator past the end of the bio.
Attack Vector
An attacker crafts a Btrfs filesystem image containing an LZO-compressed extent with a segment header specifying a length that overflows the bio's folio chain. When a victim system reads the extent, the endio worker triggers the null pointer dereference and crashes the kernel. Delivery vectors include removable media, malicious disk images, or container/VM images mounted by privileged processes.
See the upstream kernel commit 1641d05 and kernel commit b0d27d43 for the patch implementation. No public proof-of-concept is available at this time.
Detection Methods for CVE-2026-80631
Indicators of Compromise
- Kernel oops or panic logs referencing lzo_decompress_bio and end_bbio_compressed_read in the call stack
- KASAN reports showing null-ptr-deref inside the btrfs-endio workqueue (simple_end_io_work)
- Repeated worker thread crashes tied to Btrfs read operations on specific extents
Detection Strategies
- Monitor dmesg and /var/log/kern.log for Btrfs decompression faults and workqueue crashes
- Audit mount events for Btrfs filesystems originating from untrusted sources such as removable media or user-supplied images
- Correlate kernel crash telemetry with recent filesystem mount activity in centralized logging
Monitoring Recommendations
- Forward kernel logs to a central SIEM or data lake for correlation of Btrfs decompression errors across hosts
- Alert on repeated btrfs-endio worker failures indicating attempts to trigger the flaw
- Track filesystem image provenance and mount operations performed by non-root workflows
How to Mitigate CVE-2026-80631
Immediate Actions Required
- Apply the upstream Btrfs patch that rejects segments whose payload extends beyond compressed_len before copying
- Update to a stable Linux kernel release that includes the fix commits 1641d058 and b0d27d43
- Restrict mounting of Btrfs filesystems from untrusted sources to privileged administrators only
Patch Information
The fix modifies lzo_decompress_bio() to validate each segment payload against the total compressed input length, treating oversized segments as filesystem corruption. The patch is available in the kernel.org stable tree commit 1641d05 and commit b0d27d43. Distribution vendors will backport these commits into supported kernel branches.
Workarounds
- Disable auto-mount of removable Btrfs media through udev rules or desktop environment settings
- Avoid using LZO compression on Btrfs filesystems that may receive untrusted data until patched
- Enable CONFIG_BTRFS_ASSERT in custom kernel builds to convert the fault into a controlled assertion failure during testing
- Use mandatory access controls such as SELinux or AppArmor to restrict which processes can mount arbitrary filesystems
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.