CVE-2026-97415

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF

ROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed

by the subvolume name. Several readers assume that this layout is already

valid and then use the on-disk name length directly. A corrupted item can

therefore make those readers address bytes outside the item, and

BTRFS_IOC_GET_SUBVOL_INFO can copy too many bytes into its fixed-size UAPI

name buffer.

Validate ROOT_REF and ROOT_BACKREF items in tree-checker before any reader

uses them. Reject records that do not contain a non-empty name, whose

name_len does not exactly describe the remaining item payload, or whose

name exceeds BTRFS_NAME_LEN.

For BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len

instead of deriving the copy length from the item size. The ioctl result is

zeroed when allocated. That leaves the existing trailing zero byte

untouched.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References