CVE-2026-93813 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
btrfs: tree-checker: validate INODE_REF's namelen
[BUG]
A crafted btrfs image can trigger the following crash:
BUG: unable to handle page fault for address: ffffd1dc42884000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-custom+ #383 PREEMPT(full) 46af0a92938a63be7132e0dfd71e62327c51d5c2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:memcpy+0xc/0x10 Call Trace: <TASK> read_extent_buffer+0xe4/0x100 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f]
btrfs_get_name+0x15e/0x1e0 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f]
reconnect_path+0x165/0x390 exportfs_decode_fh_raw+0x337/0x400 ? drop_caches_sysctl_handler+0xb0/0xb0 </TASK> ---[ end trace 0000000000000000 ]---
RIP: 0010:memcpy+0xc/0x10 Kernel panic - not syncing: Fatal exception
[CAUSE]
TThe crafted image has the following corrupted INODE_REF item:
item 9 key (258 INODE_REF 257) itemoff 11544 itemsize 4106 index 2 namelen 4096 name: d\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000
The itemsize matches the namelen, but the namelen is 4096, way larger than normal name length limit (BTRFS_NAME_LEN, 255).
Meanwhile the memory of the @name is only 255 byte sized, this will cause out-of-boundary access, and cause the above crash.
[FIX]
Add extra namelen verification for INODE_REF, just like what we have done in ROOT_REF checks.
Now the crafted image can be rejected gracefully:
BTRFS critical (device dm-2): corrupt leaf: root=5 block=30572544 slot=14 ino=259, invalid inode ref name length, has 4096 expect [1, 255]
BTRFS error (device dm-2): read time tree block corruption detected on logical 30572544 mirror 2
[ Rebase, add a Link: tag, add an simple cause analyze ]
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel's btrfs filesystem implementation contained a critical validation deficiency within the tree-checker component that allowed crafted disk images to trigger kernel-level crashes. This vulnerability specifically affected the handling of INODE_REF items during file handle decoding operations. When a user-space process invoked exportfs_decode_fh_raw, which subsequently called reconnect_path and then read_extent_buffer, the kernel attempted to retrieve the name associated with an inode reference. The root cause lay in the insufficient validation of the namelen field within corrupted btrfs metadata structures. A maliciously constructed image could specify a namelen value significantly exceeding the maximum allowed length defined by BTRFS_NAME_LEN, which is 255 bytes. In the reported instance, a crafted item declared a name length of 4096 bytes while the actual allocated memory buffer for the name was limited to only 255 bytes. This discrepancy created an out-of-bounds read condition where the kernel attempted to copy data beyond the bounds of the allocated buffer using memcpy during the btrfs_get_name operation.
The operational impact of this flaw is severe, resulting in a supervisor write access page fault that leads directly to a kernel panic and system crash. The vulnerability allows for denial of service attacks against systems mounting untrusted or corrupted btrfs volumes. An attacker with physical access to storage media or control over network-mounted filesystem images could exploit this logic error by embedding an INODE_REF item where the declared name length exceeds the actual buffer size. This triggers a fatal exception in kernel mode, effectively halting system operations and potentially causing data loss if automatic recovery mechanisms are not robustly implemented. The crash occurs because the kernel assumes that the namelen field accurately reflects the amount of valid data available for copying into the fixed-size destination buffer, failing to enforce strict upper bounds on this value before performing memory copy operations.
From a security architecture perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read and CWE-20 Improper Input Validation. The failure to validate that the namelen does not exceed BTRFS_NAME_LEN represents a classic input validation error where trusted assumptions about metadata integrity are exploited. In terms of attack vectors, this flaw can be leveraged in scenarios involving untrusted storage media or compromised filesystem images, fitting within ATT&CK techniques related to resource hijacking via denial of service. The lack of boundary checks on structured data fields allows for memory corruption primitives that destabilize the kernel execution environment.
The resolution involves adding explicit validation logic to verify that the namelen field in INODE_REF items falls within the acceptable range of one to 255 bytes, mirroring existing safeguards implemented for ROOT_REF items. This patch ensures that corrupted images are rejected gracefully with appropriate critical and error messages logged by the btrfs subsystem rather than causing a kernel panic. Administrators should apply this update immediately if they operate systems using btrfs filesystems exposed to untrusted sources or network-mounted volumes. Mitigation strategies also include restricting access to raw block devices and implementing strict integrity checks on mounted filesystem images before mounting them in production environments. Regular updates of the Linux kernel are essential to maintain protection against such low-level memory safety violations that compromise system stability.