Linux Kernel up to 6.18.8 btrfs_compress_filemap_get_folio buffer overflow

Summaryinfo

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.18.8. Impacted is the function btrfs_compress_filemap_get_folio. The manipulation results in buffer overflow. This vulnerability is reported as CVE-2026-23147. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Linux Kernel up to 6.18.8. Affected is the function btrfs_compress_filemap_get_folio. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix the folio leak on S390 hardware acceleration [BUG] After commit aa60fe12b4f4 ("btrfs: zlib: refactor S390x HW acceleration buffer preparation"), we no longer release the folio of the page cache of folio returned by btrfs_compress_filemap_get_folio() for S390 hardware acceleration path. [CAUSE] Before that commit, we call kumap_local() and folio_put() after handling each folio. Although the timing is not ideal (it release previous folio at the beginning of the loop, and rely on some extra cleanup out of the loop), it at least handles the folio release correctly. Meanwhile the refactored code is easier to read, it lacks the call to release the filemap folio. [FIX] Add the missing folio_put() for copy_data_into_buffer().

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-23147 since 01/13/2026. The exploitability is told to be easy. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/18/2026).

The vulnerability scanner Nessus provides a plugin with the ID 299330 (Linux Distros Unpatched Vulnerability : CVE-2026-23147), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.9 eliminates this vulnerability. Applying the patch e80617a5e1c246da2f112a1a072cdd535046adfe/0d0f1314e8f86f5205f71f9e31e272a1d008e40b is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (299330). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion