CVE-2026-64567

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64567", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.797Z", "datePublished": "2026-08-05T08:08:06.015Z", "dateUpdated": "2026-10-19T20:48:42.223Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:28:41.793Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reject free space cache with more entries than pages\n\nWhen loading a v1 free space cache, __load_free_space_cache() takes\nnum_entries and num_bitmaps straight from the on-disk\nbtrfs_free_space_header. That header is stored in the tree_root under a key\nwith type 0, which the tree-checker has no case for, so neither count is\nvalidated before the load trusts it.\n\nThe load loops num_entries times and maps the next page whenever the current\none runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which\ndoes io_ctl->pages[io_ctl->index++]. But pages[] is allocated in\nio_ctl_init() from the cache inode's i_size, not from num_entries:\n\n\tnum_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);\n\tio_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);\n\nSo if num_entries claims more records than the pages can hold, io_ctl->index\nruns off the end of pages[]. The write side never hits this because\nio_ctl_add_entry() and io_ctl_add_bitmap() both stop once\nio_ctl->index >= io_ctl->num_pages; the read side just never had the same\ncheck.\n\nTo trigger it, take a clean cache (num_entries = <N> here), set num_entries\nin the header to 0x10000, and fix up the leaf checksum so it still passes\nthe tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and\npages[] is a 16-pointer (kmalloc-128) array. The load now tries to read\n65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the\narray:\n\n BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58\n io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820)\n load_free_space_cache (fs/btrfs/free-space-cache.c:1017)\n caching_thread (fs/btrfs/block-group.c:880)\n btrfs_work_helper (fs/btrfs/async-thread.c:312)\n process_one_work\n worker_thread\n kthread\n ret_from_fork\n\nfree-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc()\nat line 565, which is why that is the frame KASAN names. The out-of-bounds\nslot is then treated as a struct page and handed to crc32c(), so the bad\nread turns into a GP fault.\n\nAdd the missing check to io_ctl_check_crc(), which is where both the entry\nloop and the bitmap loop end up. When num_entries is too large the load now\nfails like any corrupt cache: __load_free_space_cache() drops it and rebuilds\nthe free space from the extent tree, so a valid cache is never rejected."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only by mounting a crafted btrfs image so caching_thread \u2192 load_free_space_cache \u2192 __load_free_space_cache runs; there is no network or adjacent protocol path into v1 free-space cache loading.\nAC:L - The attacker authors a v1 cache with inflated num_entries (and a matching leaf checksum); cache_generation auto-enables SPACE_CACHE on mount, and the OOB in io_ctl_check_crc/io_ctl_map_page is deterministic with no race or uncontrolled condition.\nPR:L - btrfs lacks FS_USERNS_MOUNT, but an unprivileged local user can loop-setup and mount a crafted image via udisks2/polkit on typical desktops/kiosks; real init-namespace root is not required.\nUI:N - In the loop/udisks mount scenario the attacker mounts the image themselves; no separate victim must open a file, click through a prompt, or otherwise interact.\nS:U - The slab OOB and resulting kernel memory misuse stay inside the host kernel's authority; no VM escape, IOMMU bypass, or sandbox boundary is crossed.\nC:H - An out-of-bounds pages[] read yields a forged struct page pointer that is passed to page_address/crc32c and then used as the source for further cache parsing, giving an arbitrary kernel-memory read primitive once adjacent slab contents are groomed.\nI:H - The forged page pointer continues into entry/bitmap load paths (including copy_page into kernel bitmaps and linking attacker-controlled free-space records), a memory-corruption primitive exploitable for arbitrary write and control-flow hijack.\nA:H - Without a valid page pointer the OOB dereference reliably faults (KASAN slab-OOB then GP fault on crc32c as in the report), crashing or oopsing the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/free-space-cache.c"], "versions": [{"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "8ded74c654a982dc8581a17b0caa7fcedb20de69", "status": "affected", "versionType": "git"}, {"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "c9c38066b6446e83668c041702bb639b0ca49363", "status": "affected", "versionType": "git"}, {"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "094734c7aaa2b36751dc32480a680a4952685e78", "status": "affected", "versionType": "git"}, {"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "33878ba25e2638bc0c61623d7a05c9ca2b74c039", "status": "affected", "versionType": "git"}, {"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2", "status": "affected", "versionType": "git"}, {"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "5e1b2ca6b34939e70fb0785e8222b53cf060016f", "status": "affected", "versionType": "git"}, {"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "f9fef131fa3f59b857217f522fa5ea430d1b707c", "status": "affected", "versionType": "git"}, {"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "a2d8d5647ed854e38f941741aea45b9eb15a6350", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/free-space-cache.c"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8ded74c654a982dc8581a17b0caa7fcedb20de69"}, {"url": "https://git.kernel.org/stable/c/c9c38066b6446e83668c041702bb639b0ca49363"}, {"url": "https://git.kernel.org/stable/c/094734c7aaa2b36751dc32480a680a4952685e78"}, {"url": "https://git.kernel.org/stable/c/33878ba25e2638bc0c61623d7a05c9ca2b74c039"}, {"url": "https://git.kernel.org/stable/c/404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2"}, {"url": "https://git.kernel.org/stable/c/5e1b2ca6b34939e70fb0785e8222b53cf060016f"}, {"url": "https://git.kernel.org/stable/c/f9fef131fa3f59b857217f522fa5ea430d1b707c"}, {"url": "https://git.kernel.org/stable/c/a2d8d5647ed854e38f941741aea45b9eb15a6350"}], "title": "btrfs: reject free space cache with more entries than pages", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64567", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:42:59.944567Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:48:42.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64567", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:42:59.944567Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:43:00.763Z"}}], "cna": {"title": "btrfs: reject free space cache with more entries than pages", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only by mounting a crafted btrfs image so caching_thread \u2192 load_free_space_cache \u2192 __load_free_space_cache runs; there is no network or adjacent protocol path into v1 free-space cache loading.\nAC:L - The attacker authors a v1 cache with inflated num_entries (and a matching leaf checksum); cache_generation auto-enables SPACE_CACHE on mount, and the OOB in io_ctl_check_crc/io_ctl_map_page is deterministic with no race or uncontrolled condition.\nPR:L - btrfs lacks FS_USERNS_MOUNT, but an unprivileged local user can loop-setup and mount a crafted image via udisks2/polkit on typical desktops/kiosks; real init-namespace root is not required.\nUI:N - In the loop/udisks mount scenario the attacker mounts the image themselves; no separate victim must open a file, click through a prompt, or otherwise interact.\nS:U - The slab OOB and resulting kernel memory misuse stay inside the host kernel's authority; no VM escape, IOMMU bypass, or sandbox boundary is crossed.\nC:H - An out-of-bounds pages[] read yields a forged struct page pointer that is passed to page_address/crc32c and then used as the source for further cache parsing, giving an arbitrary kernel-memory read primitive once adjacent slab contents are groomed.\nI:H - The forged page pointer continues into entry/bitmap load paths (including copy_page into kernel bitmaps and linking attacker-controlled free-space records), a memory-corruption primitive exploitable for arbitrary write and control-flow hijack.\nA:H - Without a valid page pointer the OOB dereference reliably faults (KASAN slab-OOB then GP fault on crc32c as in the report), crashing or oopsing the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "8ded74c654a982dc8581a17b0caa7fcedb20de69", "versionType": "git"}, {"status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "c9c38066b6446e83668c041702bb639b0ca49363", "versionType": "git"}, {"status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "094734c7aaa2b36751dc32480a680a4952685e78", "versionType": "git"}, {"status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "33878ba25e2638bc0c61623d7a05c9ca2b74c039", "versionType": "git"}, {"status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2", "versionType": "git"}, {"status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "5e1b2ca6b34939e70fb0785e8222b53cf060016f", "versionType": "git"}, {"status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "f9fef131fa3f59b857217f522fa5ea430d1b707c", "versionType": "git"}, {"status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "lessThan": "a2d8d5647ed854e38f941741aea45b9eb15a6350", "versionType": "git"}], "programFiles": ["fs/btrfs/free-space-cache.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"status": "unaffected", "version": "0", "lessThan": "3.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/btrfs/free-space-cache.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8ded74c654a982dc8581a17b0caa7fcedb20de69"}, {"url": "https://git.kernel.org/stable/c/c9c38066b6446e83668c041702bb639b0ca49363"}, {"url": "https://git.kernel.org/stable/c/094734c7aaa2b36751dc32480a680a4952685e78"}, {"url": "https://git.kernel.org/stable/c/33878ba25e2638bc0c61623d7a05c9ca2b74c039"}, {"url": "https://git.kernel.org/stable/c/404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2"}, {"url": "https://git.kernel.org/stable/c/5e1b2ca6b34939e70fb0785e8222b53cf060016f"}, {"url": "https://git.kernel.org/stable/c/f9fef131fa3f59b857217f522fa5ea430d1b707c"}, {"url": "https://git.kernel.org/stable/c/a2d8d5647ed854e38f941741aea45b9eb15a6350"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reject free space cache with more entries than pages\n\nWhen loading a v1 free space cache, __load_free_space_cache() takes\nnum_entries and num_bitmaps straight from the on-disk\nbtrfs_free_space_header. That header is stored in the tree_root under a key\nwith type 0, which the tree-checker has no case for, so neither count is\nvalidated before the load trusts it.\n\nThe load loops num_entries times and maps the next page whenever the current\none runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which\ndoes io_ctl->pages[io_ctl->index++]. But pages[] is allocated in\nio_ctl_init() from the cache inode's i_size, not from num_entries:\n\n\tnum_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);\n\tio_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);\n\nSo if num_entries claims more records than the pages can hold, io_ctl->index\nruns off the end of pages[]. The write side never hits this because\nio_ctl_add_entry() and io_ctl_add_bitmap() both stop once\nio_ctl->index >= io_ctl->num_pages; the read side just never had the same\ncheck.\n\nTo trigger it, take a clean cache (num_entries = <N> here), set num_entries\nin the header to 0x10000, and fix up the leaf checksum so it still passes\nthe tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and\npages[] is a 16-pointer (kmalloc-128) array. The load now tries to read\n65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the\narray:\n\n BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58\n io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820)\n load_free_space_cache (fs/btrfs/free-space-cache.c:1017)\n caching_thread (fs/btrfs/block-group.c:880)\n btrfs_work_helper (fs/btrfs/async-thread.c:312)\n process_one_work\n worker_thread\n kthread\n ret_from_fork\n\nfree-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc()\nat line 565, which is why that is the frame KASAN names. The out-of-bounds\nslot is then treated as a struct page and handed to crc32c(), so the bad\nread turns into a GP fault.\n\nAdd the missing check to io_ctl_check_crc(), which is where both the entry\nloop and the bitmap loop end up. When num_entries is too large the load now\nfails like any corrupt cache: __load_free_space_cache() drops it and rebuilds\nthe free space from the extent tree, so a valid cache is never rejected."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.148", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.101", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.42", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.6", "versionStartIncluding": "3.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "3.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:28:41.793Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64567", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:48:42.223Z", "dateReserved": "2026-07-19T15:36:31.797Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-05T08:08:06.015Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/btrfs/free-space-cache.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8ded74c654a982dc8581a17b0caa7fcedb20de69", "status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "versionType": "git"}, {"lessThan": "c9c38066b6446e83668c041702bb639b0ca49363", "status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "versionType": "git"}, {"lessThan": "094734c7aaa2b36751dc32480a680a4952685e78", "status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "versionType": "git"}, {"lessThan": "33878ba25e2638bc0c61623d7a05c9ca2b74c039", "status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "versionType": "git"}, {"lessThan": "404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2", "status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "versionType": "git"}, {"lessThan": "5e1b2ca6b34939e70fb0785e8222b53cf060016f", "status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "versionType": "git"}, {"lessThan": "f9fef131fa3f59b857217f522fa5ea430d1b707c", "status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "versionType": "git"}, {"lessThan": "a2d8d5647ed854e38f941741aea45b9eb15a6350", "status": "affected", "version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/btrfs/free-space-cache.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"lessThan": "3.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1F8C506-3731-4BED-AEC3-F1DA55764F3B", "versionEndExcluding": "5.10.265", "versionStartIncluding": "3.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E53EBB9F-3754-42D9-9B1B-A16E73848ED3", "versionEndExcluding": "5.15.216", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "621B79C8-2F65-4565-991D-62AAE146B524", "versionEndExcluding": "6.1.183", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6391AD0C-FE0C-4D09-8ACA-C9F7979254AE", "versionEndExcluding": "6.6.148", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4402C34-0450-4C2E-B4BF-63320A4A4FF9", "versionEndExcluding": "6.12.101", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CD263AE-3BD4-43F3-AF24-6BA22541E0C2", "versionEndExcluding": "6.18.42", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D275C711-FF65-4C57-BA4D-CD9B5D7BF0A3", "versionEndExcluding": "7.1.6", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*", "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*", "matchCriteriaId": "D6ECA620-8606-4230-A87D-3FF3EFE12592", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reject free space cache with more entries than pages\n\nWhen loading a v1 free space cache, __load_free_space_cache() takes\nnum_entries and num_bitmaps straight from the on-disk\nbtrfs_free_space_header. That header is stored in the tree_root under a key\nwith type 0, which the tree-checker has no case for, so neither count is\nvalidated before the load trusts it.\n\nThe load loops num_entries times and maps the next page whenever the current\none runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which\ndoes io_ctl->pages[io_ctl->index++]. But pages[] is allocated in\nio_ctl_init() from the cache inode's i_size, not from num_entries:\n\n\tnum_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);\n\tio_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);\n\nSo if num_entries claims more records than the pages can hold, io_ctl->index\nruns off the end of pages[]. The write side never hits this because\nio_ctl_add_entry() and io_ctl_add_bitmap() both stop once\nio_ctl->index >= io_ctl->num_pages; the read side just never had the same\ncheck.\n\nTo trigger it, take a clean cache (num_entries = <N> here), set num_entries\nin the header to 0x10000, and fix up the leaf checksum so it still passes\nthe tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and\npages[] is a 16-pointer (kmalloc-128) array. The load now tries to read\n65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the\narray:\n\n BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58\n io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820)\n load_free_space_cache (fs/btrfs/free-space-cache.c:1017)\n caching_thread (fs/btrfs/block-group.c:880)\n btrfs_work_helper (fs/btrfs/async-thread.c:312)\n process_one_work\n worker_thread\n kthread\n ret_from_fork\n\nfree-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc()\nat line 565, which is why that is the frame KASAN names. The out-of-bounds\nslot is then treated as a struct page and handed to crc32c(), so the bad\nread turns into a GP fault.\n\nAdd the missing check to io_ctl_check_crc(), which is where both the entry\nloop and the bitmap loop end up. When num_entries is too large the load now\nfails like any corrupt cache: __load_free_space_cache() drops it and rebuilds\nthe free space from the extent tree, so a valid cache is never rejected."}], "id": "CVE-2026-64567", "lastModified": "2026-11-12T19:58:33.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64567", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:42:59.944567Z", "version": "2.0.3"}}]}, "published": "2026-08-05T08:16:36.277", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/094734c7aaa2b36751dc32480a680a4952685e78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/33878ba25e2638bc0c61623d7a05c9ca2b74c039"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5e1b2ca6b34939e70fb0785e8222b53cf060016f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8ded74c654a982dc8581a17b0caa7fcedb20de69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a2d8d5647ed854e38f941741aea45b9eb15a6350"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c9c38066b6446e83668c041702bb639b0ca49363"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f9fef131fa3f59b857217f522fa5ea430d1b707c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: btrfs: reject free space cache with more entries than pages", "id": "2511408", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511408"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in btrfs, a file system in the Linux kernel. This vulnerability occurs because the system does not properly validate the number of entries in the free space cache header when loading it. A local attacker with the ability to modify the file system metadata could craft a malicious free space cache. This could lead to an out-of-bounds read, causing a system crash and resulting in a denial of service."], "name": "CVE-2026-64567", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64567\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64567\nhttps://lore.kernel.org/linux-cve-announce/2026080558-CVE-2026-64567-a7b8@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5b0e95bf607ddd59b39f52d3d55e6581c817b530,33878ba25e2638bc0c61623d7a05c9ca2b74c039)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5b0e95bf607ddd59b39f52d3d55e6581c817b530,404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5b0e95bf607ddd59b39f52d3d55e6581c817b530,5e1b2ca6b34939e70fb0785e8222b53cf060016f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5b0e95bf607ddd59b39f52d3d55e6581c817b530,f9fef131fa3f59b857217f522fa5ea430d1b707c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5b0e95bf607ddd59b39f52d3d55e6581c817b530,a2d8d5647ed854e38f941741aea45b9eb15a6350)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc4,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-05T09:30:11.490994+00:00", "updated": "2026-08-08T16:30:04.363883+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}