{"id":28662,"date":"2026-09-25T04:31:32","date_gmt":"2026-09-24T20:31:32","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97415"},"modified":"2026-09-25T04:31:32","modified_gmt":"2026-09-24T20:31:32","slug":"cve-2026-97415","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97415","title":{"rendered":"CVE-2026-97415 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tree-checker:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF<\/p>\n<p>ROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed<br \/>\nby the subvolume name. Several readers assume that this layout is already<br \/>\nvalid and then use the on-disk name length directly. A corrupted item can<br \/>\ntherefore make those readers address bytes outside the item, and<br \/>\nBTRFS_IOC_GET_SUBVOL_INFO can copy too many bytes into its fixed-size UAPI<br \/>\nname buffer.<\/p>\n<p>Validate ROOT_REF and ROOT_BACKREF items in tree-checker before any reader<br \/>\nuses them. Reject records that do not contain a non-empty name, whose<br \/>\nname_len does not exactly describe the remaining item payload, or whose<br \/>\nname exceeds BTRFS_NAME_LEN.<\/p>\n<p>For BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len<br \/>\ninstead of deriving the copy length from the item size. The ioctl result is<br \/>\nzeroed when allocated. That leaves the existing trailing zero byte<br \/>\nuntouched.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF<\/p>\n<p>ROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref f<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28662","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}