{"id":28628,"date":"2026-09-25T04:31:29","date_gmt":"2026-09-24T20:31:29","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93813"},"modified":"2026-09-25T04:31:29","modified_gmt":"2026-09-24T20:31:29","slug":"cve-2026-93813","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93813","title":{"rendered":"CVE-2026-93813 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tree-checker:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>btrfs: tree-checker: validate INODE_REF&#8217;s namelen<\/p>\n<p>[BUG]<br \/>\nA crafted btrfs image can trigger the following crash:<\/p>\n<p>  BUG: unable to handle page fault for address: ffffd1dc42884000<br \/>\n  #PF: supervisor write access in kernel mode<br \/>\n  #PF: error_code(0x0002) &#8211; not-present page<br \/>\n  CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-custom+ #383 PREEMPT(full)  46af0a92938a63be7132e0dfd71e62327c51d5c2<br \/>\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02\/02\/2022<br \/>\n  RIP: 0010:memcpy+0xc\/0x10<br \/>\n  Call Trace:<\/p>\n<p>   read_extent_buffer+0xe4\/0x100 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f]<br \/>\n   btrfs_get_name+0x15e\/0x1e0 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f]<br \/>\n   reconnect_path+0x165\/0x390<br \/>\n   exportfs_decode_fh_raw+0x337\/0x400<br \/>\n   ? drop_caches_sysctl_handler+0xb0\/0xb0<\/p>\n<p>  &#8212;[ end trace 0000000000000000 ]&#8212;<br \/>\n  RIP: 0010:memcpy+0xc\/0x10<br \/>\n  Kernel panic &#8211; not syncing: Fatal exception<\/p>\n<p>[CAUSE]<br \/>\nTThe crafted image has the following corrupted INODE_REF item:<\/p>\n<p>         item 9 key (258 INODE_REF 257) itemoff 11544 itemsize 4106<br \/>\n         \tindex 2 namelen 4096 name: d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000<\/p>\n<p>The itemsize matches the namelen, but the namelen is 4096, way larger<br \/>\nthan normal name length limit (BTRFS_NAME_LEN, 255).<\/p>\n<p>Meanwhile the memory of the @name is only 255 byte sized, this will cause<br \/>\nout-of-boundary access, and cause the above crash.<\/p>\n<p>[FIX]<br \/>\nAdd extra namelen verification for INODE_REF, just like what we have<br \/>\ndone in ROOT_REF checks.<\/p>\n<p>Now the crafted image can be rejected gracefully:<\/p>\n<p> BTRFS critical (device dm-2): corrupt leaf: root=5 block=30572544 slot=14 ino=259, invalid inode ref name length, has 4096 expect [1, 255]<br \/>\n BTRFS error (device dm-2): read time tree block corruption detected on logical 30572544 mirror 2<\/p>\n<p>[ Rebase, add a Link: tag, add an simple cause analyze ]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>btrfs: tree-checker: validate INODE_REF&#8217;s namelen<\/p>\n<p>[BUG]<br \/>\nA crafted btrfs image can trigger the following crash:<\/p>\n<p>  BUG: unable to h<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28628","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28628"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28628"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}