In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, __load_free_space_cache() takes n…
High CVSS 7.8
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, __load_free_space_cache() takes num_entries and num_bitmaps straight from the on-disk btrfs_free_space_header. That header is stored in the tree_root under a key with type 0, which the tree-checker has no case for, so neither count is validated before the load trusts it. The load loops num_entries times and maps the next page when…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/33878ba25e2638bc0c61623d7a05c9ca2b74c039
- https://git.kernel.org/stable/c/404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2
- https://git.kernel.org/stable/c/5e1b2ca6b34939e70fb0785e8222b53cf060016f
- https://git.kernel.org/stable/c/a2d8d5647ed854e38f941741aea45b9eb15a6350
- https://git.kernel.org/stable/c/f9fef131fa3f59b857217f522fa5ea430d1b707c
Timeline
- nvd_ingest NVD