CVE-2026-80631

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Btrfs LZO decompression process where the lzo decompress bio() function fails to validate the on-disk segment length seg len against the total compressed input size compressed len. Instead, it only checks the length against the workspace cbuf size. A specially crafted extent can include a segment that passes the cbuf check but exceeds the end of the bio, causing the copy compressed segment() function to read past the last folio. This leads to a null-pointer dereference when get current folio() returns a NULL folio from bio next folio() and folio size(NULL) is called, resulting in a system fault.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.