CVE-2026-93813

btrfs: tree-checker: validate INODE_REF's namelen

State: Published
Severity: 7.8 High
Published: Sep 24, 2026
Updated: Oct 3, 2026
Reserved: Sep 18, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: tree-checker: validate INODE_REF's namelen

[BUG] A crafted btrfs image can trigger the following crash:

BUG: unable to handle page fault for address: ffffd1dc42884000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-custom+ #383 PREEMPT(full) 46af0a92938a63be7132e0dfd71e62327c51d5c2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:memcpy+0xc/0x10 Call Trace: <TASK> read_extent_buffer+0xe4/0x100 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] btrfs_get_name+0x15e/0x1e0 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f] reconnect_path+0x165/0x390 exportfs_decode_fh_raw+0x337/0x400 ? drop_caches_sysctl_handler+0xb0/0xb0 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:memcpy+0xc/0x10 Kernel panic - not syncing: Fatal exception

[CAUSE] TThe crafted image has the following corrupted INODE_REF item:

item 9 key (258 INODE_REF 257) itemoff 11544 itemsize 4106 index 2 namelen 4096 name: d\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000

The itemsize matches the namelen, but the namelen is 4096, way larger than normal name length limit (BTRFS_NAME_LEN, 255).

Meanwhile the memory of the @name is only 255 byte sized, this will cause out-of-boundary access, and cause the above crash.

[FIX] Add extra namelen verification for INODE_REF, just like what we have done in ROOT_REF checks.

Now the crafted image can be rejected gracefully:

BTRFS critical (device dm-2): corrupt leaf: root=5 block=30572544 slot=14 ino=259, invalid inode ref name length, has 4096 expect [1, 255] BTRFS error (device dm-2): read time tree block corruption detected on logical 30572544 mirror 2

[ Rebase, add a Link: tag, add an simple cause analyze ]

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2ede0daf01549cecf4bb0962c46dc47382047523 to before 60078a3e25c09d9d8fba828b0d81bb33e449a1b2Affected 2ede0daf01549cecf4bb0962c46dc47382047523 to before 509d6a4d889e425f305461d8323a7b39ca6c121cAffected 2ede0daf01549cecf4bb0962c46dc47382047523 to before 4cb41f07685f88ec724a375883bb0c731db8f6ebAffected 2ede0daf01549cecf4bb0962c46dc47382047523 to before eeddee090b834a7d4b6a8214d2e3739e64c7a338Affected 2ede0daf01549cecf4bb0962c46dc47382047523 to before 8f75c19892263bc0555fba922aefe103e841e86dAffected 2ede0daf01549cecf4bb0962c46dc47382047523 to before 3dc22abc21f5892406c09202fa2627196cc96967Affected
LinuxLinux	2.6.37Affected before 2.6.37Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

2ede0daf01549cecf4bb0962c46dc47382047523 to before 60078a3e25c09d9d8fba828b0d81bb33e449a1b2Affected
2ede0daf01549cecf4bb0962c46dc47382047523 to before 509d6a4d889e425f305461d8323a7b39ca6c121cAffected
2ede0daf01549cecf4bb0962c46dc47382047523 to before 4cb41f07685f88ec724a375883bb0c731db8f6ebAffected
2ede0daf01549cecf4bb0962c46dc47382047523 to before eeddee090b834a7d4b6a8214d2e3739e64c7a338Affected
2ede0daf01549cecf4bb0962c46dc47382047523 to before 8f75c19892263bc0555fba922aefe103e841e86dAffected
2ede0daf01549cecf4bb0962c46dc47382047523 to before 3dc22abc21f5892406c09202fa2627196cc96967Affected

LinuxLinux

2.6.37Affected
before 2.6.37Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.