CVE-2026-80631

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: lzo: reject compressed segment that overflows the compressed input

lzo_decompress_bio() validates each on-disk segment length seg_len only

against the workspace cbuf size, not against the compressed input size

(compressed_len, the total folio bytes of the bio). A crafted extent can

carry a segment whose seg_len passes the cbuf check but runs past the end

of the bio, so copy_compressed_segment() walks off the last folio:

get_current_folio() then returns the NULL folio from bio_next_folio(), and

with CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults.

BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs/btrfs/lzo.c:383)

Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29

Workqueue: btrfs-endio simple_end_io_work

kasan_report (mm/kasan/report.c:590)

lzo_decompress_bio (fs/btrfs/lzo.c:383)

end_bbio_compressed_read (fs/btrfs/compression.c:1065)

btrfs_bio_end_io (fs/btrfs/bio.c:1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References