{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  btrfs: lzo: reject inline extents without valid headers  [BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent:    BUG: KASAN: slab-out-of-bounds in lzo_decompress+0x57d/0x700   Read of size 4 at addr ffff888006f2e644 by task btrfs_lzo_inlin/77    Call Trace:    \u003cTASK\u003e    dump_stack_lvl+0x5b/0x70    print_report+0xd1/0x610    kasan_report+0xe0/0x110    __asan_report_load_n_noabort+0x13/0x20    lzo_decompress+0x57d/0x700    btrfs_decompress+0x140/0x1c0    uncompress_inline+0x147/0x1b0    btrfs_get_extent+0xb23/0x10a0    btrfs_do_readpage.constprop.0+0x538/0x1ac0    btrfs_readahead+0x32f/0x5f0    read_pages+0x16f/0x850    page_cache_ra_unbounded+0x296/0x490    do_page_cache_ra+0xd9/0x130    page_cache_sync_ra+0x3ee/0x6f0    filemap_get_pages+0x306/0x15c0    filemap_read+0x329/0xd00    btrfs_file_read_iter+0x1f8/0x2b0    vfs_read+0x4ef/0x720    ksys_read+0xf8/0x1d0    __x64_sys_read+0x71/0xb0    x64_sys_call+0x1ab0/0x1b70    do_syscall_64+0x61/0x470    entry_SYSCALL_64_after_hwframe+0x4b/0x53    \u003c/TASK\u003e  [CAUSE] For an inline lzo compressed file extent, there should always be one lzo header, recording the total length of the compressed data, followed by one segment header, recording the compressed lzo payload.  But if a crafted inline lzo compressed file extent contains only an lzo header, without the segment header or payload, lzo_decompress() will still try to read the segment header, causing a read beyond the item boundary.  Furthermore if the inline lzo compressed file extent is the first item of the leaf, it will be at the extent buffer boundary. The above out-of-boundary read will go beyond the extent buffer boundary, triggering the above KASAN report.  [FIX] Validate the total length of the inlined lzo compressed file extent, to make sure there is at least one LZO header and one segment header, and a non-zero payload.  [ Rework the commit message to remove slop ]",
  "id": "DEBIAN-CVE-2026-74723",
  "modified": "2026-09-14T16:47:39.521110028Z",
  "published": "2026-08-22T16:16:47.323Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74723"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-74723"
  ]
}