CVE-2026-80631

CVE-2026-80631 is a missing bounds check in the Linux kernel's btrfs LZO decompression path: lzo_decompress_bio() validates each on-disk segment length (seg_len) only against the workspace cbuf size and not against the total compressed input size (compressed_len). A crafted or corrupt btrfs extent can therefore contain a segment whose length passes the cbuf check but runs past the end of the compressed input, so copy_compressed_segment() walks off the last folio, bio_next_folio() returns NULL, and folio_size(NULL) faults, crashing the kernel (KASAN null-pointer read at address 0 in lzo_decompress_bio, fs/btrfs/lzo.c:383). An attacker who can get such crafted on-disk data read from an LZO-compressed btrfs volume gains a kernel denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N, A:H only) indicates no confidentiality or integrity impact. Any Linux system running a kernel with the flawed btrfs LZO code is potentially affected, but only when btrfs volumes using LZO compression are read; note the crash occurs by default (CONFIG_BTRFS_ASSERT disabled). No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS estimates a 0.3% probability of exploitation within 30 days.

What to do: Install kernel updates from your distribution that incorporate the upstream btrfs LZO fix (the advisory does not list fixed version numbers, so track your vendor's kernel advisory). Until patched, avoid mounting or attaching btrfs filesystems or images of untrusted provenance that use LZO compression, and treat any null-pointer-deref crash reports in lzo_decompress_bio (fs/btrfs/lzo.c) as this vulnerability rather than failing hardware.