---
title: "CVE-2026-97415: Linux Kernel - Buffer Overflow"
description: "Linux kernel contains a buffer overflow vulnerability in BTRFS due to improper validation of ROOT_REF and ROOT_BACKREF item names, letting attackers cause out-of-bounds reads, exploit requires crafted corrupted items."
url: https://panop.io/threat-heartbeat/CVE-2026-97415/
---

# CVE-2026-97415 Linux Kernel - Buffer Overflow

Linux kernel contains a buffer overflow vulnerability in BTRFS due to improper validation of ROOT\_REF and ROOT\_BACKREF item names, letting attackers cause out-of-bounds reads, exploit requires crafted corrupted items.

CVSS base score 7.8 /10

High

CISA KEV

Not listed

Public exploit

None known

Authentication

Required

EPSS

0.13% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-97415)

## Details

Type

Buffer Overflow

Impact

Information Disclosure, Denial Of Service

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Published

24 September 2026

Updated

15 October 2026

## Vendor fix

Update to the latest Linux kernel version with the fix for BTRFS tree-checker validation.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-97415](https://nvd.nist.gov/vuln/detail/CVE-2026-97415)
- [https://git.kernel.org/stable/c/74f577c722c99248d804eca18e7de7c5e47549d7](https://git.kernel.org/stable/c/74f577c722c99248d804eca18e7de7c5e47549d7)
- [https://git.kernel.org/stable/c/9154542070ca7eadb3c764a882f39a127677854b](https://git.kernel.org/stable/c/9154542070ca7eadb3c764a882f39a127677854b)
- [https://git.kernel.org/stable/c/1370badf6b823ce3cde39a65f46f9e5dc7b4bf43](https://git.kernel.org/stable/c/1370badf6b823ce3cde39a65f46f9e5dc7b4bf43)
- [https://git.kernel.org/stable/c/ba6c4fc662853f6662e4db060cf88ee994053e21](https://git.kernel.org/stable/c/ba6c4fc662853f6662e4db060cf88ee994053e21)
- [https://git.kernel.org/stable/c/0af37c217edf15fa21dac1c40822086df356c6bb](https://git.kernel.org/stable/c/0af37c217edf15fa21dac1c40822086df356c6bb)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)