CVE-2026-97415

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF<br /> <br /> ROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed<br /> by the subvolume name. Several readers assume that this layout is already<br /> valid and then use the on-disk name length directly. A corrupted item can<br /> therefore make those readers address bytes outside the item, and<br /> BTRFS_IOC_GET_SUBVOL_INFO can copy too many bytes into its fixed-size UAPI<br /> name buffer.<br /> <br /> Validate ROOT_REF and ROOT_BACKREF items in tree-checker before any reader<br /> uses them. Reject records that do not contain a non-empty name, whose<br /> name_len does not exactly describe the remaining item payload, or whose<br /> name exceeds BTRFS_NAME_LEN.<br /> <br /> For BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len<br /> instead of deriving the copy length from the item size. The ioctl result is<br /> zeroed when allocated. That leaves the existing trailing zero byte<br /> untouched.