CVE-2026-97415 btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF
A missing validation in the Linux kernel btrfs filesystem allows corrupted items to cause out-of-bounds reads, potentially leading to memory corruption or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97415?
CVE-2026-97415 is a high-severity memory corruption vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF
ROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed by the subvolume name. Several readers assume that this layout is already valid and then use the on-disk name length directly. A corrupted item can therefore make those readers address bytes outside the item, and BTRFS_IOC_GET_SUBVOL_INFO can copy too many bytes into its fixed-size UAPI name buffer.
Validate ROOT_REF and ROOT_BACKREF items in tree-checker before any reader uses them. Reject records that do not contain a non-empty name, whose name_len does not exactly describe the remaining item payload, or whose name exceeds BTRFS_NAME_LEN.
For BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len instead of deriving the copy length from the item size. The ioctl result is zeroed when allocated. That leaves the existing trailing zero byte untouched.
Which versions are affected by CVE-2026-97415?
How do I fix CVE-2026-97415?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-97415 being exploited?
There is no known exploitation of CVE-2026-97415 in the wild and no public exploit code.
Sources
Also known as AZL-103943, BELL-CVE-2026-97415, DEBIAN-CVE-2026-97415, GHSA-8vvp-6p8q-q9pq, UBUNTU-CVE-2026-97415.