Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs during log replay At __inode_add_ref() when processing extrefs, if we jump into the next label we have an undefined value of victim_name.len, since we haven't initialized it before we did the goto. This results in an invalid memory access in the next iteration of the loop since victim_name.len was not initialized to the length of the name of the current extref. Fix this by initializing victim_name.len with the current extref's name length.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1cf474cd474bc5d3ef63086ffd009a87a5b7bb2e to < 539969fc472886a1d63565459514d47e27fef461affectede43eec81c5167b655b72c781b0e75e62a05e415e to < 2d11d274e2e1d7c79e2ca8461ce3ff3a95c11171affectede43eec81c5167b655b72c781b0e75e62a05e415e to < 7ac790dc2ba00499a8d671d4a24de4d4ad27e234affectede43eec81c5167b655b72c781b0e75e62a05e415e to < aee57a0293dca675637e5504709f9f8fd8e871beaffectede43eec81c5167b655b72c781b0e75e62a05e415e to < 54a7081ed168b72a8a2d6ef4ba3a1259705a2926affected6.1.57 to < 6.1.144affected
Linux Linux
Default version status: affected
6.2affected0 to < 6.2unaffected6.1.144 to ≤ 6.1.*unaffected6.6.97 to ≤ 6.6.*unaffected6.12.37 to ≤ 6.12.*unaffected6.15.6 to ≤ 6.15.*unaffected6.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/539969fc472886a1d63565459514d47e27fef461 ↗
- https://git.kernel.org/stable/c/2d11d274e2e1d7c79e2ca8461ce3ff3a95c11171 ↗
- https://git.kernel.org/stable/c/7ac790dc2ba00499a8d671d4a24de4d4ad27e234 ↗
- https://git.kernel.org/stable/c/aee57a0293dca675637e5504709f9f8fd8e871be ↗
- https://git.kernel.org/stable/c/54a7081ed168b72a8a2d6ef4ba3a1259705a2926 ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗