CVE-2026-74723

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: lzo: reject inline extents without valid headers<br /> <br /> [BUG]<br /> For a crafted btrfs image, the following KASAN can be triggered when<br /> reading an inline lzo compressed file extent:<br /> <br /> BUG: KASAN: slab-out-of-bounds in lzo_decompress+0x57d/0x700<br /> Read of size 4 at addr ffff888006f2e644 by task btrfs_lzo_inlin/77<br /> <br /> Call Trace:<br /> <br /> dump_stack_lvl+0x5b/0x70<br /> print_report+0xd1/0x610<br /> kasan_report+0xe0/0x110<br /> __asan_report_load_n_noabort+0x13/0x20<br /> lzo_decompress+0x57d/0x700<br /> btrfs_decompress+0x140/0x1c0<br /> uncompress_inline+0x147/0x1b0<br /> btrfs_get_extent+0xb23/0x10a0<br /> btrfs_do_readpage.constprop.0+0x538/0x1ac0<br /> btrfs_readahead+0x32f/0x5f0<br /> read_pages+0x16f/0x850<br /> page_cache_ra_unbounded+0x296/0x490<br /> do_page_cache_ra+0xd9/0x130<br /> page_cache_sync_ra+0x3ee/0x6f0<br /> filemap_get_pages+0x306/0x15c0<br /> filemap_read+0x329/0xd00<br /> btrfs_file_read_iter+0x1f8/0x2b0<br /> vfs_read+0x4ef/0x720<br /> ksys_read+0xf8/0x1d0<br /> __x64_sys_read+0x71/0xb0<br /> x64_sys_call+0x1ab0/0x1b70<br /> do_syscall_64+0x61/0x470<br /> entry_SYSCALL_64_after_hwframe+0x4b/0x53<br /> <br /> <br /> [CAUSE]<br /> For an inline lzo compressed file extent, there should always be one lzo<br /> header, recording the total length of the compressed data, followed by<br /> one segment header, recording the compressed lzo payload.<br /> <br /> But if a crafted inline lzo compressed file extent contains only an lzo<br /> header, without the segment header or payload, lzo_decompress() will<br /> still try to read the segment header, causing a read beyond the item<br /> boundary.<br /> <br /> Furthermore if the inline lzo compressed file extent is the first item<br /> of the leaf, it will be at the extent buffer boundary. The above<br /> out-of-boundary read will go beyond the extent buffer boundary,<br /> triggering the above KASAN report.<br /> <br /> [FIX]<br /> Validate the total length of the inlined lzo compressed file extent, to<br /> make sure there is at least one LZO header and one segment header, and a<br /> non-zero payload.<br /> <br /> [ Rework the commit message to remove slop ]