CVE-2026-64567

A flaw was found in btrfs, a file system in the Linux kernel. This vulnerability occurs because the system does not properly validate the number of entries in the free space cache header when loading it. A local attacker with the ability to modify the file system metadata could craft a malicious free space cache. This could lead to an out-of-bounds read, causing a system crash and resulting in a denial of service.

A moderate-impact denial-of-service flaw was found in the btrfs file system in the Red Hat Enterprise Linux kernel. When loading a v1 free space cache, __load_free_space_cache() takes the num_entries and num_bitmaps counts directly from the on-disk btrfs_free_space_header without validating them against the number of pages allocated for the cache inode. A local attacker with the ability to modify file system metadata could craft a free space cache header that claims more entries than the backing pages can hold and fix up the leaf checksum so the cache still passes validation; loading such a cache then drives io_ctl->index past the end of the pages[] array in io_ctl_check_crc(), causing a slab-out-of-bounds read that turns into a general protection fault and kernel panic. The verified impact is a system crash and denial of service only: no information disclosure, privilege escalation, or data integrity impact has been demonstrated. For this reason Red Hat rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), a meaningful difference from the CVE.org score of 7.8, which assumes high confidentiality and integrity impacts that the technical evidence does not support. Within Red Hat products, the kernel packages of Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 10, and the Red Hat In-Vehicle OS (rhivos) streams are affected, with the fix currently deferred; the residual risk of the deferral is limited to a local denial of service by an attacker who can already modify btrfs file system metadata on the target system. The Red Hat Enterprise Linux 8 and 9 kernel and kernel-rt streams are marked not affected because the vulnerable code is not present in those builds, and Red Hat Enterprise Linux 6 ELS is out of active support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.