CVE-2026-80631

In the Linux kernel, the following vulnerability has been resolved:

btrfs: lzo: reject compressed segment that overflows the compressed input

lzo decompress bio() validates each on-disk segment length seg len only against the workspace cbuf size, not against the compressed input size (compressed len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg len passes the cbuf check but runs past the end of the bio, so copy compressed segment() walks off the last folio: get current folio() then returns the NULL folio from bio next folio(), and with CONFIG BTRFS ASSERT disabled (default) folio size(NULL) faults.

BUG: KASAN: null-ptr-deref in lzo decompress bio (fs/btrfs/lzo.c:383) Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29 Workqueue: btrfs-endio simple end io work kasan report (mm/kasan/report.c:590) lzo decompress bio (fs/btrfs/lzo.c:383) end bbio compressed read (fs/btrfs/compression.c:1065) btrfs bio end io (fs/btrfs/bio.c:135) btrfs check read bio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285) simple end io work process one work worker thread

Reject any segment whose payload would extend beyond compressed len before copying it, treating it as corruption like the other on-disk validation failures in this function.