{"api_version":"1","generated_at":"2026-08-24T11:42:57+00:00","cve":"CVE-2026-68167","urls":{"html":"https://cve.report/CVE-2026-68167","api":"https://cve.report/api/cve/CVE-2026-68167.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68167","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68167"},"summary":{"title":"btrfs: do not try compression for data reloc inodes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not try compression for data reloc inodes\n\n[BUG]\nThere is a syzbot report that the check inside get_new_location()\ntriggered:\n\n  BTRFS info (device loop0): found 31 extents, stage: move data extents\n  BTRFS info (device loop0): leaf 8908800 gen 16 total ptrs 28 free space 1676 owner 18446744073709551607\n         item 0 key (256 INODE_ITEM 0) itemoff 3835 itemsize 160\n                 inode generation 5 transid 0 size 0 nbytes 0\n                 block group 0 mode 40755 links 1 uid 0 gid 0\n                 rdev 0 sequence 0 flags 0x0\n                 atime 1669132761.0\n                 ctime 1669132761.0\n                 mtime 1669132761.0\n                 otime 0.0\n         item 1 key (256 INODE_REF 256) itemoff 3823 itemsize 12\n                 index 0 name_len 2\n         item 2 key (258 INODE_ITEM 0) itemoff 3663 itemsize 160\n                 inode generation 1 transid 16 size 733184 nbytes 106496\n                 block group 0 mode 100600 links 0 uid 0 gid 0\n                 rdev 0 sequence 24 flags 0x18\n         item 3 key (258 EXTENT_DATA 0) itemoff 3595 itemsize 68\n                 generation 16 type 0\n                 inline extent data size 47 ram_bytes 4096 compression 1\n  [...]\n         item 27 key (18446744073709551611 ORPHAN_ITEM 258) itemoff 2376 itemsize 0\n  BTRFS error (device loop0): unexpected non-zero offset in file extent item for data reloc inode 258 key offset 0 offset 9277520992061368337\n  ------------[ cut here ]------------\n  btrfs_abort_should_print_stack(__error)\n\n[CAUSE]\nThe above dump tree shows the first file extent item is inlined, which\nshould make no sense for data reloc inodes, as such inodes just\nrepresent where the data extents are in the relocation destination chunk.\n\nHowever the relocation path preallocates space for each block,\nthen dirties them, cluster by cluster.\nIt's possible to have a single block at the beginning of the block\ngroup, and no other block in the same cluster.\n\nSo relocation will preallocate a file extent for that block and dirty\nthe first block.  Then memory pressure forces the data reloc inode to be\nwritten back, before any other blocks are dirtied/allocated.\n\nFinally commit 3eaf5f082c4c (\"btrfs: extract inlined creation into a dedicated\ndelalloc helper\") changed the sequence of delalloc. Before that commit we\nalways tried NOCOW first, so that dirtied block would be written back into\nthe preallocated space, and appear as a regular extent.\n\nBut with that commit, we always try inline first, and since compression\nis forced, we try compressing the first block, and then inline the\ncompressed data, resulting in the above inlined file extent in the data\nreloc tree.\n\nThen the check in get_new_location() will check the file offset, without\nchecking if the file extent is inlined or not, resulting in the above\nfailure.\n\n[FIX]\nDo not allow compression for data reloc inodes.\n\nSince data reloc inode sizes are always block aligned, as long as we do\nnot compress, @data_len will always be at least one block, and\nthat will cause can_cow_file_range_inline() to return false, thus no\ninlined extent will be created.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:03","updated_at":"2026-08-17 05:18:17"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/ae4316f332e03e628712e9dfb89f2b7d3c70c21a","name":"https://git.kernel.org/stable/c/ae4316f332e03e628712e9dfb89f2b7d3c70c21a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/31a62e4ad66313cf1ebaa00c2a17d644a4b87d22","name":"https://git.kernel.org/stable/c/31a62e4ad66313cf1ebaa00c2a17d644a4b87d22","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68167","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68167","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3eaf5f082c4cc71dea70bee23355bf63b24df303 31a62e4ad66313cf1ebaa00c2a17d644a4b87d22 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3eaf5f082c4cc71dea70bee23355bf63b24df303 ae4316f332e03e628712e9dfb89f2b7d3c70c21a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.1","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68167","cve":"CVE-2026-68167","epss":"0.001890000","percentile":"0.088820000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/btrfs_inode.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"31a62e4ad66313cf1ebaa00c2a17d644a4b87d22","status":"affected","version":"3eaf5f082c4cc71dea70bee23355bf63b24df303","versionType":"git"},{"lessThan":"ae4316f332e03e628712e9dfb89f2b7d3c70c21a","status":"affected","version":"3eaf5f082c4cc71dea70bee23355bf63b24df303","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/btrfs_inode.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"7.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not try compression for data reloc inodes\n\n[BUG]\nThere is a syzbot report that the check inside get_new_location()\ntriggered:\n\n  BTRFS info (device loop0): found 31 extents, stage: move data extents\n  BTRFS info (device loop0): leaf 8908800 gen 16 total ptrs 28 free space 1676 owner 18446744073709551607\n         item 0 key (256 INODE_ITEM 0) itemoff 3835 itemsize 160\n                 inode generation 5 transid 0 size 0 nbytes 0\n                 block group 0 mode 40755 links 1 uid 0 gid 0\n                 rdev 0 sequence 0 flags 0x0\n                 atime 1669132761.0\n                 ctime 1669132761.0\n                 mtime 1669132761.0\n                 otime 0.0\n         item 1 key (256 INODE_REF 256) itemoff 3823 itemsize 12\n                 index 0 name_len 2\n         item 2 key (258 INODE_ITEM 0) itemoff 3663 itemsize 160\n                 inode generation 1 transid 16 size 733184 nbytes 106496\n                 block group 0 mode 100600 links 0 uid 0 gid 0\n                 rdev 0 sequence 24 flags 0x18\n         item 3 key (258 EXTENT_DATA 0) itemoff 3595 itemsize 68\n                 generation 16 type 0\n                 inline extent data size 47 ram_bytes 4096 compression 1\n  [...]\n         item 27 key (18446744073709551611 ORPHAN_ITEM 258) itemoff 2376 itemsize 0\n  BTRFS error (device loop0): unexpected non-zero offset in file extent item for data reloc inode 258 key offset 0 offset 9277520992061368337\n  ------------[ cut here ]------------\n  btrfs_abort_should_print_stack(__error)\n\n[CAUSE]\nThe above dump tree shows the first file extent item is inlined, which\nshould make no sense for data reloc inodes, as such inodes just\nrepresent where the data extents are in the relocation destination chunk.\n\nHowever the relocation path preallocates space for each block,\nthen dirties them, cluster by cluster.\nIt's possible to have a single block at the beginning of the block\ngroup, and no other block in the same cluster.\n\nSo relocation will preallocate a file extent for that block and dirty\nthe first block.  Then memory pressure forces the data reloc inode to be\nwritten back, before any other blocks are dirtied/allocated.\n\nFinally commit 3eaf5f082c4c (\"btrfs: extract inlined creation into a dedicated\ndelalloc helper\") changed the sequence of delalloc. Before that commit we\nalways tried NOCOW first, so that dirtied block would be written back into\nthe preallocated space, and appear as a regular extent.\n\nBut with that commit, we always try inline first, and since compression\nis forced, we try compressing the first block, and then inline the\ncompressed data, resulting in the above inlined file extent in the data\nreloc tree.\n\nThen the check in get_new_location() will check the file offset, without\nchecking if the file extent is inlined or not, resulting in the above\nfailure.\n\n[FIX]\nDo not allow compression for data reloc inodes.\n\nSince data reloc inode sizes are always block aligned, as long as we do\nnot compress, @data_len will always be at least one block, and\nthat will cause can_cow_file_range_inline() to return false, thus no\ninlined extent will be created."}],"providerMetadata":{"dateUpdated":"2026-08-17T05:00:07.591Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/31a62e4ad66313cf1ebaa00c2a17d644a4b87d22"},{"url":"https://git.kernel.org/stable/c/ae4316f332e03e628712e9dfb89f2b7d3c70c21a"}],"title":"btrfs: do not try compression for data reloc inodes","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68167","datePublished":"2026-08-10T11:59:35.630Z","dateReserved":"2026-07-30T09:28:09.372Z","dateUpdated":"2026-08-17T05:00:07.591Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:03","lastModifiedDate":"2026-08-17 05:18:17","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68167","Ordinal":"1","Title":"btrfs: do not try compression for data reloc inodes","CVE":"CVE-2026-68167","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68167","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not try compression for data reloc inodes\n\n[BUG]\nThere is a syzbot report that the check inside get_new_location()\ntriggered:\n\n  BTRFS info (device loop0): found 31 extents, stage: move data extents\n  BTRFS info (device loop0): leaf 8908800 gen 16 total ptrs 28 free space 1676 owner 18446744073709551607\n         item 0 key (256 INODE_ITEM 0) itemoff 3835 itemsize 160\n                 inode generation 5 transid 0 size 0 nbytes 0\n                 block group 0 mode 40755 links 1 uid 0 gid 0\n                 rdev 0 sequence 0 flags 0x0\n                 atime 1669132761.0\n                 ctime 1669132761.0\n                 mtime 1669132761.0\n                 otime 0.0\n         item 1 key (256 INODE_REF 256) itemoff 3823 itemsize 12\n                 index 0 name_len 2\n         item 2 key (258 INODE_ITEM 0) itemoff 3663 itemsize 160\n                 inode generation 1 transid 16 size 733184 nbytes 106496\n                 block group 0 mode 100600 links 0 uid 0 gid 0\n                 rdev 0 sequence 24 flags 0x18\n         item 3 key (258 EXTENT_DATA 0) itemoff 3595 itemsize 68\n                 generation 16 type 0\n                 inline extent data size 47 ram_bytes 4096 compression 1\n  [...]\n         item 27 key (18446744073709551611 ORPHAN_ITEM 258) itemoff 2376 itemsize 0\n  BTRFS error (device loop0): unexpected non-zero offset in file extent item for data reloc inode 258 key offset 0 offset 9277520992061368337\n  ------------[ cut here ]------------\n  btrfs_abort_should_print_stack(__error)\n\n[CAUSE]\nThe above dump tree shows the first file extent item is inlined, which\nshould make no sense for data reloc inodes, as such inodes just\nrepresent where the data extents are in the relocation destination chunk.\n\nHowever the relocation path preallocates space for each block,\nthen dirties them, cluster by cluster.\nIt's possible to have a single block at the beginning of the block\ngroup, and no other block in the same cluster.\n\nSo relocation will preallocate a file extent for that block and dirty\nthe first block.  Then memory pressure forces the data reloc inode to be\nwritten back, before any other blocks are dirtied/allocated.\n\nFinally commit 3eaf5f082c4c (\"btrfs: extract inlined creation into a dedicated\ndelalloc helper\") changed the sequence of delalloc. Before that commit we\nalways tried NOCOW first, so that dirtied block would be written back into\nthe preallocated space, and appear as a regular extent.\n\nBut with that commit, we always try inline first, and since compression\nis forced, we try compressing the first block, and then inline the\ncompressed data, resulting in the above inlined file extent in the data\nreloc tree.\n\nThen the check in get_new_location() will check the file offset, without\nchecking if the file extent is inlined or not, resulting in the above\nfailure.\n\n[FIX]\nDo not allow compression for data reloc inodes.\n\nSince data reloc inode sizes are always block aligned, as long as we do\nnot compress, @data_len will always be at least one block, and\nthat will cause can_cow_file_range_inline() to return false, thus no\ninlined extent will be created.","Type":"Description","Title":"btrfs: do not try compression for data reloc inodes"}]}}}