Linux Kernel LZO Decompression Buffer Overflow Vulnerability

CVE-2026-80631 is a buffer overflow vulnerability in the Linux kernel's btrfs LZO decompression function that allows a crafted extent to cause a read past the end of allocated memory. The vulnerability exists because lzo_decompress_bio() validates segment length (seg_len) only against the decompression workspace buffer size, not against the actual compressed input size. An attacker can craft a malicious btrfs filesystem with a segment whose length passes the workspace validation but extends beyond the compressed data, causing the copy_compressed_segment() function to read into adjacent memory. This affects any system using btrfs with LZO compression, particularly those processing untrusted filesystem images, and could lead to information disclosure or denial of service.

While CVE-2026-80631 lacks mapped MITRE ATT&CK techniques and CWE classification, Casky's AI-driven analysis would identify this as a memory safety violation pattern relevant to Exploitation of Vulnerability (T1190) and potentially Local Privilege Escalation (T1548) if chained with kernel exploitation techniques. Practitioners using Casky would observe detection signals around: (1) Anomalous buffer access patterns during filesystem decompression operations, (2) Crafted filesystem metadata that violates expected compression segment boundaries, and (3) Kernel memory access violations originating from btrfs subsystem calls. Security teams monitoring btrfs filesystem operations would see these patterns manifest as kernel warnings, out-of-bounds access attempts, or unexpected memory reads during LZO decompression processing—particularly when processing filesystems from untrusted sources.