CVE-2026-80631

In the Linux kernel, the following vulnerability has been resolved:

btrfs: lzo: reject compressed segment that overflows the compressed input

lzodecompressbio() validates each on-disk segment length seglen only against the workspace cbuf size, not against the compressed input size (compressedlen, the total folio bytes of the bio). A crafted extent can carry a segment whose seglen passes the cbuf check but runs past the end of the bio, so copycompressedsegment() walks off the last folio: getcurrentfolio() then returns the NULL folio from bionextfolio(), and with CONFIGBTRFSASSERT disabled (default) foliosize(NULL) faults.

BUG: KASAN: null-ptr-deref in lzodecompressbio (fs/btrfs/lzo.c:383) Read of size 8 at addr 0000000000000000 by task kworker/u8:1/29 Workqueue: btrfs-endio simpleendiowork kasanreport (mm/kasan/report.c:590) lzodecompressbio (fs/btrfs/lzo.c:383) endbbiocompressedread (fs/btrfs/compression.c:1065) btrfsbioendio (fs/btrfs/bio.c:135) btrfscheckreadbio (fs/btrfs/bio.c:180 fs/btrfs/bio.c:285) simpleendiowork processonework worker_thread

Reject any segment whose payload would extend beyond compressed_len before copying it, treating it as corruption like the other on-disk validation failures in this function.