CVE-2026-80631

A flaw was found in the Linux kernel's Btrfs filesystem, specifically within its LZO decompression functionality. A local attacker could provide a specially crafted Btrfs image containing a compressed segment that, due to improper validation of its length, overflows the compressed input buffer. This out-of-bounds read leads to a null-pointer dereference, which can cause a system crash, resulting in a Denial of Service (DoS).

A MODERATE impact denial-of-service flaw in the Linux kernel's Btrfs LZO decompression path affects the kernel packages in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. The lzo_decompress_bio() function validated each on-disk compressed segment length only against the workspace buffer size and not against the total compressed input length of the read bio. A crafted Btrfs filesystem image containing such an oversized compressed segment therefore causes copy_compressed_segment() to read past the end of the last folio, producing a NULL pointer dereference in folio_size() and a kernel crash. Exploitation requires local access and the ability to supply or control the contents of a Btrfs filesystem image (for example, by mounting one), and the consequence is limited to loss of availability: there is no impact on confidentiality or integrity and no privilege escalation. Red Hat rates this flaw MODERATE with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); this is lower than the upstream CVE.org score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) because the flaw is not network reachable and is triggered only through local filesystem I/O on a crafted or corrupted Btrfs image, which typically requires elevated privileges to create or mount. Red Hat Enterprise Linux 7, 8, and 9, including their kernel-rt variants, are not affected because the vulnerable code is not present in those kernel versions, and Red Hat Enterprise Linux 6 is out of support scope. For the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 kernel streams the resolution is DEFER: the fix is deferred to a future scheduled kernel update rather than an immediate update, and given the local, availability-only nature of this flaw the residual risk of the deferral is a system crash triggered by an attacker who can already control or supply the contents of a Btrfs filesystem.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.