Medium · published February 14, 2026
In the Linux kernel, the following vulnerability has been resolved:
btrfs: send: check for inline extents in range_is_hole_in_parent()
Before accessing the disk_bytenr field of a file extent item we need
to check if we are dealing with an inline extent.
This is because for inline extents their data starts at the offset of
the disk_bytenr field. So accessing the disk_bytenr
means we are accessing inline data or in case the inline data is less
than 8 bytes we can actually cause an invalid
memory access if this inline extent item is the first item in the leaf
or access metadata from other items.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.11, < 6.6.122 | 6.6.122 |
| linux/linux_kernel | ≥ 6.7, < 6.12.67 | 6.12.67 |
| linux/linux_kernel | ≥ 6.13, < 6.18.7 | 6.18.7 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |