CVE-2026-74723

A flaw was found in the Linux kernel. A local attacker could craft a btrfs image with a malformed LZO compressed file extent. This could lead to an out-of-bounds read during decompression, potentially causing a denial of service.

This vulnerability is rated as Moderate severity because exploitation is restricted to local vectors and requires mounting an untrusted file system volume, which generally demands administrative privileges. In standard Red Hat Enterprise Linux configurations, Btrfs is not enabled as the default storage format, substantially limiting the attack surface. Although unpacking an invalid inline segment causes an out-of-bounds memory read leading to a kernel crash and system denial of service, it does not allow privilege elevation or code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.