External risk intelligence

Linux Kernel Btrfs LZO Inline Extent Header Validation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74723

This vulnerability is located deep within the Linux kernel's Btrfs file system handling code for processing compressed inline extents. It requires an attacker to provide or induce the system to process a specifically crafted local file system image. It is not a network service or protocol exposed to the internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the Linux kernel's file system handling could allow a specially crafted file to cause a system error when read. While the direct impact is a kernel crash, the primary concern for leadership is to confirm if this specific file system feature is in use and if any crafted files could be introduced to the environment.

Files can crash the system when read.
Affects Linux kernel's file compression.
Confirm relevance to your environment.

Attack Path

How an attacker could exploit the issue

An attacker could craft a malicious btrfs filesystem image containing a specially malformed compressed file extent. When the Linux kernel attempts to read this malformed extent, a flaw in the LZO decompression logic can cause it to read beyond the allocated buffer. This out-of-bounds read could lead to system instability or crashes.

Requires local file system access.
Triggered by reading a crafted compressed file.
Risks system instability or crashes.

Live Threat

Current exploitation, exposure, and threat context

When a crafted btrfs image is processed, reading a specially prepared inline LZO compressed file extent could cause a kernel memory read beyond boundaries. This condition could occur when the operating system handles compressed data within the btrfs filesystem.

Kernel memory could be read.
Crafted local filesystem image.
System instability or crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

Ownership of this Linux kernel vulnerability rests with the team responsible for managing and updating the kernel, likely the Infrastructure or Platform Engineering team. The first actionable step is to identify all systems running the affected kernel, assess their exposure to crafted btrfs images, and confirm the business criticality of those systems. Subsequently, a coordinated remediation plan should be developed.

Kernel team owns the issue.
Verify systems with affected kernel.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Btrfs file system in the Linux kernel?

Btrfs, or B-tree file system, is a modern file system for Linux designed for fault tolerance, repair, and easy administration. It includes advanced features like native compression to save disk space. The vulnerability exists within the logic the kernel uses to decompress specific types of data, known as inline extents, when they are stored directly within the file system metadata rather than in separate data blocks.

What is the vulnerability in CVE-2026-74723?

This is a memory safety issue categorized as an out-of-bounds read. It happens because the Btrfs LZO decompression code does not properly verify that an inline compressed file contains all the required headers and data segments before attempting to process them. Because the code assumes these headers are present, it reads past the expected memory boundaries when they are missing or malformed, which can lead to a system crash.

How is this Btrfs vulnerability triggered?

The flaw is triggered when the kernel attempts to read a specifically crafted, malformed Btrfs file system image containing a corrupted inline compressed file extent. It is not triggered by standard file system operations on healthy data, nor by the simple existence of such a file on disk. The system must actually process the contents of the maliciously prepared file for the decompression logic to encounter the error.

Do I need to worry about this if my system is internet-facing?

According to Halo Surface Signal, this vulnerability is considered very unlikely to be exploited remotely. The issue is deeply embedded in how the kernel handles internal file system structures. An attacker would generally need a way to introduce a crafted Btrfs image to your system, which is a much higher barrier than common network-based attacks. It is primarily a concern for systems that process untrusted or externally sourced Btrfs disk images.

When should I update my system for this kernel issue?

You should coordinate with your infrastructure or platform engineering team to prioritize updates based on your use of Btrfs. Start by identifying which servers or workstations in your environment use this file system. If you rely on Btrfs, ensure that kernel update management processes are in place to receive the latest patches from your distribution provider, which address this validation logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.