CVE-2026-64567

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the btrfs file system when loading a v1 free space cache. The function load free space cache() trusts the num entries and num bitmaps values from the on-disk btrfs free space header without validation. Because the pages[] array is allocated based on the cache inode's i size rather than num entries, a specially crafted header with a large num entries value can cause the io ctl->index to exceed the array bounds during the execution of io ctl check crc() and io ctl map page(). This slab-out-of-bounds read can lead to a general protection (GP) fault when the out-of-bounds memory is processed by crc32c().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.