All vulnerabilities
CVE-2026-93813

Linux: btrfs: tree-checker: validate INODE_REF's namelen

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in60078a3e25c09d9d8fba828b0d81bb33e449a1b2Also 509d6a4d889e425f305461d8323a7b39ca6c121c, 4cb41f07685f88ec724a375883bb0c731db8f6eb and 2 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 60078a3e25c09d9d8fba828b0d81bb33e449a1b2LinuxCVE List
  • 509d6a4d889e425f305461d8323a7b39ca6c121cLinuxCVE List
  • 4cb41f07685f88ec724a375883bb0c731db8f6ebLinuxCVE List
  • 8f75c19892263bc0555fba922aefe103e841e86dLinuxCVE List
  • 3dc22abc21f5892406c09202fa2627196cc96967LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: tree-checker: validate INODE_REF's namelen

[BUG] A crafted btrfs image can trigger the following crash:

BUG: unable to handle page fault for address: ffffd1dc42884000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-custom+ #383 PREEMPT(full) 46af0a92938a63be7132e0dfd71e62327c51d5c2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:memcpy+0xc/0x10 Call Trace: <TASK> read_extent_buffer+0xe4/0x100 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] btrfs_get_name+0x15e/0x1e0 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] reconnect_path+0x165/0x390 exportfs_decode_fh_raw+0x337/0x400 ? drop_caches_sysctl_handler+0xb0/0xb0 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:memcpy+0xc/0x10 Kernel panic - not syncing: Fatal exception

[CAUSE] TThe crafted image has the following corrupted INODE_REF item:

item 9 key (258 INODE_REF 257) itemoff 11544 itemsize 4106 index 2 namelen 4096 name: d\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000

The itemsize matches the namelen, but the namelen is 4096, way larger than normal name length limit (BTRFS_NAME_LEN, 255).

Meanwhile the memory of the @name is only 255 byte sized, this will cause out-of-boundary access, and cause the above crash.

[FIX] Add extra namelen verification for INODE_REF, just like what we have done in ROOT_REF checks.

Now the crafted image can be rejected gracefully:

BTRFS critical (device dm-2): corrupt leaf: root=5 block=30572544 slot=14 ino=259, invalid inode ref name length, has 4096 expect [1, 255] BTRFS error (device dm-2): read time tree block corruption detected on logical 30572544 mirror 2

[ Rebase, add a Link: tag, add an simple cause analyze ]

Text from CVE List

Affected versions 14

  • Linuxaffected: 2ede0daf01549cecf4bb0962c46dc47382047523 before 60078a3e25c09d9d8fba828b0d81bb33e449a1b2CVE List
  • Linuxaffected: 2ede0daf01549cecf4bb0962c46dc47382047523 before 509d6a4d889e425f305461d8323a7b39ca6c121cCVE List
  • Linuxaffected: 2ede0daf01549cecf4bb0962c46dc47382047523 before 4cb41f07685f88ec724a375883bb0c731db8f6ebCVE List
  • Linuxaffected: 2ede0daf01549cecf4bb0962c46dc47382047523 before eeddee090b834a7d4b6a8214d2e3739e64c7a338CVE List
  • Linuxaffected: 2ede0daf01549cecf4bb0962c46dc47382047523 before 8f75c19892263bc0555fba922aefe103e841e86dCVE List
  • Linuxaffected: 2ede0daf01549cecf4bb0962c46dc47382047523 before 3dc22abc21f5892406c09202fa2627196cc96967CVE List
  • Linuxaffected: 2.6.37CVE List
  • Linuxunaffected: all versions before 2.6.37CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 6