---
id: CVE-2026-23141
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: send: check for inline extents in range_is_hole_in_parent()

  Before accessing the disk_bytenr field of a file extent item we need
  to check if we are dealing with…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: send: check for inline extents in range_is_hole_in_parent()

  Before accessing the disk_bytenr field of a file extent item we need
  to check if we are dealing with…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.11, < 6.6.122'
  - 'linux_kernel >= 6.7, < 6.12.67'
  - 'linux_kernel >= 6.13, < 6.18.7'
  - linux_kernel = 6.19
patched:
  - linux_kernel 6.18.7
published: '2026-02-14'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:18:43.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23141'
references:
  - url: 'https://git.kernel.org/stable/c/08b096c1372cd69627f4f559fb47c9fb67a52b39'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/39f83f10772310ba4a77f2b5256aaf36994ef7e8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/901e581bfc44d181f7d9c3f11880dac3e89deb2e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d948055bd46a9c14d1d4217aed65c5c258c32903'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/db00636643e66898d79f2530ac9c56ebd5eca369'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f2dc6ab3a14c2d2eb0b14783427eb9b03bf631c9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00143
epssPercentile: 0.03244
ingestedAt: '2026-10-15T03:30:12.834Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: send: check for inline extents in range_is_hole_in_parent()

Before accessing the disk_bytenr field of a file extent item we need
to check if we are dealing with an inline extent.
This is because for inline extents their data starts at the offset of
the disk_bytenr field. So accessing the disk_bytenr
means we are accessing inline data or in case the inline data is less
than 8 bytes we can actually cause an invalid
memory access if this inline extent item is the first item in the leaf
or access metadata from other items.

## Affected

- `linux_kernel >= 4.11, < 6.6.122`
- `linux_kernel >= 6.7, < 6.12.67`
- `linux_kernel >= 6.13, < 6.18.7`
- `linux_kernel = 6.19`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.18.7`