CVE-2026-80530: Linux Kernel XFS Privilege Escalation Flaw

CVE-2026-80530 Overview

CVE-2026-80530 is a Linux kernel vulnerability in the XFS filesystem's exchange-range implementation. The flaw resides in xmi_can_exchange_reflink_flags(), which incorrectly transfers the reflink inode flag between files when XFS_EXCHMAPS_INO1_WRITTEN is requested. The routine assumes all shared extents are exchanged, but xfs_exchmaps_can_skip_mapping() can skip hole and unwritten mappings from file1. As a result, the reflink flag can be cleared from an inode that still owns shared written extents. Subsequent writes then take the non-reflink path and may modify blocks that copy-on-write (CoW) should have protected, producing silent data corruption between reflink-related files.

Critical Impact
A local authenticated user performing exchange-range operations on XFS reflink files can trigger silent data corruption across shared extents.

Affected Products

Linux kernel — XFS filesystem exchange-range subsystem
Distributions shipping affected stable kernel branches referenced by the kernel.org commits
Systems using XFS reflink features and FIEXCHANGE_RANGE ioctl operations

Discovery Timeline

2026-08-26 - CVE-2026-80530 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80530

Vulnerability Analysis

The XFS exchange-range operation swaps mappings between two files. When exactly one of the two files has the reflink inode flag set, xmi_can_exchange_reflink_flags() transfers that flag to the other inode. This behavior relies on the invariant that the entire file contents, including every shared extent, are exchanged during the operation.

The invariant breaks when the caller sets XFS_EXCHMAPS_INO1_WRITTEN. In that mode, xfs_exchmaps_can_skip_mapping() skips hole and unwritten mappings originating from file1. The exchange completes without moving every mapping that the earlier flag-swap decision accounted for. The post-operation cleanup then clears the reflink flag from an inode that still owns shared written extents.

Once the flag is cleared incorrectly, later writes bypass the CoW write path. Writes update blocks in place instead of allocating new extents. Data corruption manifests as unexpected changes visible across reflink-related files that were expected to remain independent after CoW.

Root Cause

The root cause is a business-logic inconsistency between the flag-exchange decision and the actual mapping-exchange execution. The flag decision assumes a complete content swap while the mapping code selectively skips holes and unwritten regions when XFS_EXCHMAPS_INO1_WRITTEN is active. The two code paths disagree on what "exchange" means, leading to metadata that no longer reflects on-disk sharing state.

Attack Vector

Exploitation requires local access with permission to invoke exchange-range ioctls on XFS files. The attacker triggers an exchange-range operation with XFS_EXCHMAPS_INO1_WRITTEN between a reflinked file and a non-reflinked target. After the reflink flag is cleared on an inode still holding shared extents, subsequent writes to those blocks corrupt data in files that share the same extents. See the fix commits on kernel.org for the exact code path.

Detection Methods for CVE-2026-80530

Indicators of Compromise

Unexpected data changes appearing across files that were previously reflinked or share extents on XFS
xfs_info and xfs_bmap output showing inodes without the reflink flag that still map to shared physical extents
Filesystem integrity check (xfs_repair -n) reporting inconsistencies between inode flags and shared extent ownership

Detection Strategies

Audit for user-space processes invoking FIEXCHANGE_RANGE or ioctl_xfs_exchangerange on XFS mounts, especially with the XFS_EXCHMAPS_INO1_WRITTEN flag
Compare kernel package versions against fixed stable kernel builds referenced in the kernel.org commits
Correlate reflink-heavy workloads (container image layers, snapshot tooling) with unexpected file-content divergence

Monitoring Recommendations

Enable audit rules for XFS ioctl syscalls involving exchange-range operations on production data volumes
Schedule periodic xfs_repair -n runs on backup or snapshot copies to identify metadata inconsistencies
Monitor kernel logs for XFS warnings related to reflink accounting or shared extent operations

How to Mitigate CVE-2026-80530

Immediate Actions Required

Apply the stable kernel updates containing the fix commits 03c9c911, 0f27b223, 2efbd889, and b2d5a81d from kernel.org
Inventory all XFS filesystems using reflink and identify workloads that invoke exchange-range operations
Validate integrity of reflinked datasets and restore from known-good backups where corruption is suspected

Patch Information

The fix disables the reflink flag exchange whenever XFS_EXCHMAPS_INO1_WRITTEN is requested. The content exchange still proceeds, but both inodes conservatively retain the reflink flag. The regular reflink flag cleanup path drops the extra flag later once an inode no longer has shared extents. Fixes are available at commit 03c9c911, commit 0f27b223, commit 2efbd889, and commit b2d5a81d.

Workarounds

Restrict local access to systems hosting XFS reflink data and limit which users can invoke exchange-range ioctls
Avoid application workflows that combine FIEXCHANGE_RANGE with XFS_EXCHMAPS_INO1_WRITTEN on reflinked files until patched kernels are deployed
Prefer standard cp --reflink or snapshot workflows that do not rely on exchange-range semantics for reflinked datasets

bash

# Verify running kernel and XFS reflink status
uname -r
xfs_info /path/to/mount | grep reflink
# Confirm patched kernel is installed after update
rpm -q kernel   # RHEL/Fedora
dpkg -l linux-image-$(uname -r)   # Debian/Ubuntu