CVE-2026-80531: Linux Kernel XFS Use-After-Free Vulnerability

CVE-2026-80531 is a use-after-free vulnerability in the Linux kernel XFS filesystem affecting tempfile creation code. This flaw can lead to memory corruption if exploitation occurs during failed operations. This article covers technical details, affected kernel versions, security impact, and mitigation strategies.

CVE-2026-80531 Overview

CVE-2026-80531 is a use-after-free (UAF) vulnerability in the Linux kernel's XFS filesystem code. The flaw resides in the xrep_tempfile_create function, which handles temporary inode creation during online filesystem repair. When tempfile creation fails after sc->tempip has been set, the kernel can dereference a freed inode pointer. The issue was identified through the LOLLM analysis tool and has been resolved upstream. Local attackers with the ability to trigger XFS repair operations can leverage the flaw for memory corruption and privilege escalation.

Critical Impact
A local user can trigger a use-after-free in XFS online repair code, potentially achieving kernel memory corruption and privilege escalation with high confidentiality, integrity, and availability impact.

Affected Products

Linux kernel with XFS online repair (CONFIG_XFS_ONLINE_REPAIR) enabled
Stable kernel branches receiving commits 08a20776, 0c88e10d, 96246a32, and cd1f876d
Distributions shipping affected upstream XFS repair code

Discovery Timeline

2026-08-26 - CVE-2026-80531 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80531

Vulnerability Analysis

The vulnerability affects the XFS online repair subsystem in the Linux kernel. The xrep_tempfile_create function creates a temporary inode used to stage repairs of on-disk metadata. During creation, the function assigns the newly allocated inode pointer to sc->tempip on the scrub context structure. If a subsequent step in the creation path fails, the inode is released, but sc->tempip retains the stale pointer. Later cleanup routines dereference sc->tempip, resulting in a use-after-free on kernel memory.

An attacker able to invoke XFS scrub or repair ioctls on a mounted filesystem can steer the failure path and reclaim the freed slab object. Because the freed object is a kernel struct xfs_inode, controlled reallocation offers a foothold for arbitrary kernel read or write primitives.

Root Cause

The root cause is missing pointer sanitization on the error path of xrep_tempfile_create. The code sets sc->tempip before all failure conditions are cleared, and it does not reset the field to NULL when tempfile creation aborts. Subsequent teardown logic assumes sc->tempip references a live inode.

Attack Vector

Exploitation requires local access with permission to issue XFS repair or scrub operations, typically CAP_SYS_ADMIN inside a namespace with a mounted XFS filesystem. The attacker forces xrep_tempfile_create to fail after sc->tempip is assigned, then triggers the cleanup path that dereferences the stale pointer. No user interaction is required, and the attack completes within a single privileged process context. The upstream fix, distributed across kernel commits 08a20776ce33, 0c88e10d12de, 96246a3200d3, and cd1f876d1bc2, ensures sc->tempip is not left dangling on failure.

See the Kernel Patch Commit 08a20776 for the applied source-level fix.

Detection Methods for CVE-2026-80531

Indicators of Compromise

Kernel Oops, general protection fault, or KASAN: use-after-free messages referencing xrep_tempfile_create or xfs_inode in dmesg
Unexpected calls to ioctl(XFS_IOC_SCRUB_METADATA) from unprivileged or non-administrative workloads
Repeated XFS scrub failures on the same inode class followed by process crashes or panics

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) or KFENCE on test systems to catch UAF conditions during fuzzing or QA
Audit which processes invoke XFS_IOC_SCRUB_METADATA and correlate against expected administrative tooling
Deploy eBPF probes on the xrep_tempfile_create entry and error paths to identify anomalous failure rates

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on XFS-related fault signatures
Track kernel version and patch status across the fleet to confirm patched builds are deployed
Monitor for privilege escalation follow-on activity, such as unexpected uid=0 transitions after XFS scrub calls

How to Mitigate CVE-2026-80531

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 08a20776, 0c88e10d, 96246a32, and cd1f876d
Update to a distribution kernel that incorporates the XFS repair fix and reboot affected hosts
Restrict CAP_SYS_ADMIN and disallow untrusted users from invoking XFS scrub or repair ioctls

Patch Information

The fix ensures sc->tempip is cleared on the failure path of xrep_tempfile_create, eliminating the stale pointer that led to the use-after-free. Patches are available in the stable kernel tree via Kernel Patch Commit 0c88e10d, Kernel Patch Commit 96246a32, and Kernel Patch Commit cd1f876d. Rebuild and redeploy custom kernels from these commits or install the vendor-supplied update.

Workarounds

Disable or unload XFS online repair functionality where operationally acceptable until patched kernels are deployed
Restrict access to XFS-mounted volumes and remove unnecessary administrative privileges from interactive users
Isolate multi-tenant workloads that share XFS filesystems using separate mount namespaces or dedicated hosts

bash

# Confirm running kernel version and XFS scrub availability
uname -r
xfs_scrub -V

# Restrict scrub tooling to root and audit invocations
chmod 750 /usr/sbin/xfs_scrub
auditctl -w /usr/sbin/xfs_scrub -p x -k xfs_scrub_exec