Out-of-bounds read in Linux kernel - CVE-2026-64567
Published: August 6, 2026
Vulnerability identifier: #VU141041
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64567
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in io_ctl_check_crc() in the btrfs free space cache loader when loading a corrupted v1 free space cache. A local user can modify free space cache header counts to exceed the number of allocated pages to cause a denial of service.
The invalid out-of-bounds slot is treated as a struct page and can lead to a general protection fault during crc32c() processing.
Affected software
Linux kernel
How to mitigate CVE-2026-64567
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/33878ba25e2638bc0c61623d7a05c9ca2b74c039
- https://git.kernel.org/stable/c/404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2
- https://git.kernel.org/stable/c/5e1b2ca6b34939e70fb0785e8222b53cf060016f
- https://git.kernel.org/stable/c/a2d8d5647ed854e38f941741aea45b9eb15a6350
- https://git.kernel.org/stable/c/f9fef131fa3f59b857217f522fa5ea430d1b707c