Bug 2439863 (CVE-2026-23141)

Summary: CVE-2026-23141 kernel: btrfs: send: check for inline extents in range_is_hole_in_parent()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's btrfs filesystem send functionality. In the range_is_hole_in_parent() function, the code accesses the disk_bytenr field of a file extent item without first checking if it is an inline extent. For inline extents, the data begins at the disk_bytenr field offset, so accessing it as a disk address reads inline data incorrectly. If the inline data is less than 8 bytes and the extent is the first item in a leaf, this can cause an invalid memory access.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-02-14 16:02:17 UTC 
In the Linux kernel, the following vulnerability has been resolved:

btrfs: send: check for inline extents in range_is_hole_in_parent()

Before accessing the disk_bytenr field of a file extent item we need
to check if we are dealing with an inline extent.
This is because for inline extents their data starts at the offset of
the disk_bytenr field. So accessing the disk_bytenr
means we are accessing inline data or in case the inline data is less
than 8 bytes we can actually cause an invalid
memory access if this inline extent item is the first item in the leaf
or access metadata from other items.
Comment 1 Alexander B 2026-02-16 11:32:37 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026021415-CVE-2026-23141-c6bd@gregkh/T