CVE-2026-23141

A flaw was found in the Linux kernel's btrfs filesystem send functionality. In the range_is_hole_in_parent() function, the code accesses the disk_bytenr field of a file extent item without first checking if it is an inline extent. For inline extents, the data begins at the disk_bytenr field offset, so accessing it as a disk address reads inline data incorrectly. If the inline data is less than 8 bytes and the extent is the first item in a leaf, this can cause an invalid memory access.

This flaw affects btrfs send operations when processing filesystems containing inline extents with specific layouts. The issue requires a crafted or unusual btrfs filesystem structure to trigger. Systems not using btrfs or not performing send operations are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.