CVE-2026-64567

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: reject free space cache with more entries than pages

When loading a v1 free space cache, __load_free_space_cache() takes

num_entries and num_bitmaps straight from the on-disk

btrfs_free_space_header. That header is stored in the tree_root under a key

with type 0, which the tree-checker has no case for, so neither count is

validated before the load trusts it.

The load loops num_entries times and maps the next page whenever the current

one runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which

does io_ctl->pages[io_ctl->index++]. But pages[] is allocated in

io_ctl_init() from the cache inode's i_size, not from num_entries:

num_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);

io_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);

So if num_entries claims more records than the pages can hold, io_ctl->index

runs off the end of pages[]. The write side never hits this because

io

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References