All vulnerabilities
CVE-2026-97415

Linux: btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1370badf6b823ce3cde39a65f46f9e5dc7b4bf43Also 9154542070ca7eadb3c764a882f39a127677854b, 74f577c722c99248d804eca18e7de7c5e47549d7 and 1 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 1370badf6b823ce3cde39a65f46f9e5dc7b4bf43LinuxCVE List
  • 9154542070ca7eadb3c764a882f39a127677854bLinuxCVE List
  • 74f577c722c99248d804eca18e7de7c5e47549d7LinuxCVE List
  • 0af37c217edf15fa21dac1c40822086df356c6bbLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF

ROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed by the subvolume name. Several readers assume that this layout is already valid and then use the on-disk name length directly. A corrupted item can therefore make those readers address bytes outside the item, and BTRFS_IOC_GET_SUBVOL_INFO can copy too many bytes into its fixed-size UAPI name buffer.

Validate ROOT_REF and ROOT_BACKREF items in tree-checker before any reader uses them. Reject records that do not contain a non-empty name, whose name_len does not exactly describe the remaining item payload, or whose name exceeds BTRFS_NAME_LEN.

For BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len instead of deriving the copy length from the item size. The ioctl result is zeroed when allocated. That leaves the existing trailing zero byte untouched.

Text from CVE List

Affected versions 12

  • Linuxaffected: b64ec075bded2b30bcd90af5aa5256d2237c885d before 1370badf6b823ce3cde39a65f46f9e5dc7b4bf43CVE List
  • Linuxaffected: b64ec075bded2b30bcd90af5aa5256d2237c885d before ba6c4fc662853f6662e4db060cf88ee994053e21CVE List
  • Linuxaffected: b64ec075bded2b30bcd90af5aa5256d2237c885d before 9154542070ca7eadb3c764a882f39a127677854bCVE List
  • Linuxaffected: b64ec075bded2b30bcd90af5aa5256d2237c885d before 74f577c722c99248d804eca18e7de7c5e47549d7CVE List
  • Linuxaffected: b64ec075bded2b30bcd90af5aa5256d2237c885d before 0af37c217edf15fa21dac1c40822086df356c6bbCVE List
  • Linuxaffected: 4.18CVE List
  • Linuxunaffected: all versions before 4.18CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 5