CVE-2026-31666

Vulnerability

Description

A bug was introduced in the Linux kernel's btrfs filesystem within the function lookup_extent_data_ref() after commit 1618aa3c2e01. The refactoring merged the 'err' and 'ret' variables into a single variable 'ret'. However, when btrfs_next_leaf() returns 0 (indicating successful advancement to the next leaf), the 'ret' variable, which previously held -ENOENT, is overwritten to 0. If the first key in the next leaf does not match the expected objectid or type, the function incorrectly returns 0 instead of -ENOENT.

Attack

Vector and Exploitation Prerequisites

This is a local vulnerability that requires the ability to trigger specific btrfs operations that call lookup_extent_data_ref(). The bug manifests after a refactoring commit, meaning systems running kernels that include that commit are affected. No special network position or authentication beyond local access to the filesystem is needed; the flaw lies entirely in kernel code logic.

Impact

Because the function returns 0 (success) even when the lookup fails, the caller proceeds to operate on a wrong extent tree item. This can lead to reading or modifying the incorrect extent record, resulting in extent tree corruption. In a worst-case scenario, this corruption could cause data integrity issues, loss of filesystem consistency, or a system crash.

Mitigation

Status

The fix has been applied to the Linux kernel, with stable kernel commits addressing the issue [1][2][3][4]. Users should update to a kernel version containing the fix. No workaround is available apart from applying the kernel patch.