CVE-2026-80529: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80529 Overview

CVE-2026-80529 describes a Linux kernel flaw in the XFS filesystem log recovery path. The function xlog_recover_dquot_commit_pass2() validates a recovered disk quota (dquot) with xfs_dqblk_verify(). On failure, it sets error = -EFSCORRUPTED and jumps to the out_release label. However, out_release unconditionally returns 0, so the corruption error is discarded. The caller xlog_recover_items_pass2() interprets the outcome as success, log recovery proceeds, and the corrupt quota buffer can be written back to disk. The upstream fix ensures verification failures propagate to the caller.

Critical Impact
Corrupted dquot records survive XFS log recovery and can be persisted to disk, undermining filesystem integrity and quota enforcement.

Affected Products

Linux kernel — XFS filesystem log recovery code path in fs/xfs/xfs_dquot_item_recover.c
Stable branches referenced in the linked kernel.org commits
Systems using XFS with quota features enabled

Discovery Timeline

2026-08-26 - CVE-2026-80529 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80529

Vulnerability Analysis

The defect sits in XFS journal replay logic. When the kernel replays quota items from the log, it runs xfs_dqblk_verify() to confirm that each recovered dquot passes structural checks. When verification fails, the code correctly sets error = -EFSCORRUPTED and branches to the shared cleanup label out_release. The bug is that the cleanup path returns 0 unconditionally, discarding the local error value.

Because the caller xlog_recover_items_pass2() receives 0, it treats the item as successfully recovered. Recovery continues, and the in-memory buffer holding the malformed dquot can be flushed back to disk during normal writeback. The result is filesystem corruption that a mount-time check was designed to catch but silently allowed through.

This is an error-handling defect rather than a memory-safety flaw. It falls under improper check of function return value and affects data integrity of an on-disk structure that governs storage quotas.

Root Cause

The out_release label serves multiple exit paths, including the normal success case, and returns 0 without consulting the error variable set on the corruption branch. The verification result is set but never returned to the caller, so log recovery cannot distinguish a valid dquot from a rejected one.

Attack Vector

Exploitation requires a crafted or damaged XFS filesystem with a corrupt dquot record in the journal. Local access sufficient to mount the crafted image, or a pre-existing on-disk corruption event, can trigger the flaw during log replay. The vulnerability does not describe a remote or unauthenticated network path. See the upstream commits for the exact patch:

No verified proof-of-concept code is published in the referenced sources.

Detection Methods for CVE-2026-80529

Indicators of Compromise

Kernel log messages from XFS during mount referencing dquot verification, EFSCORRUPTED, or quota buffer errors
Later xfs_repair runs reporting inconsistent or invalid dquot structures on volumes that previously mounted cleanly
Discrepancies between accounted quota usage and actual on-disk consumption after an unclean shutdown and log replay

Detection Strategies

Compare running kernel versions against the fixed commits listed on kernel.org and flag hosts on unpatched stable branches
Audit mount-time dmesg output for XFS quota warnings and correlate with subsequent filesystem inconsistencies
Periodically run xfs_repair -n on XFS volumes with quotas enabled to surface silently persisted corruption

Monitoring Recommendations

Forward kernel and filesystem logs to a centralized log platform and alert on XFS EFSCORRUPTED events
Track unclean shutdown counts and follow-up mount messages for XFS filesystems using project or user quotas
Monitor kernel package versions across the fleet to confirm the fix is deployed on all XFS hosts

How to Mitigate CVE-2026-80529

Immediate Actions Required

Update the Linux kernel to a version containing the upstream fix from the commits referenced above
Reboot affected hosts after patching to activate the corrected XFS log recovery code path
Run xfs_repair on volumes suspected of having completed a log replay on a vulnerable kernel

Patch Information

The fix returns the EFSCORRUPTED error from xlog_recover_dquot_commit_pass2() instead of discarding it in the out_release path, so log recovery aborts on a bad dquot. The patch was applied across multiple stable branches; consult the Linux Kernel Commit 36a31b12 reference and the associated backports for the branch matching your kernel.

Workarounds

Disable XFS quotas where operationally acceptable by mounting without usrquota, grpquota, or prjquota options until the kernel is patched
Avoid mounting untrusted or externally sourced XFS images on unpatched systems
Ensure clean shutdowns to reduce the frequency of log replay on affected kernels

bash

# Verify running kernel and XFS mount options
uname -r
mount | grep xfs

# Offline integrity check on an unmounted XFS volume
sudo xfs_repair -n /dev/sdX