CVE-2026-80532 Overview
CVE-2026-80532 affects the Linux kernel's XFS filesystem online repair code. The flaw resides in xrep_iunlink_resolve_bucket, which reconstructs incore prev and next unlinked list pointers during online filesystem check (fsck). Crafted or corrupted on-disk next_unlinked pointers can drive the reconstruction routine into an infinite loop. This condition consumes CPU resources and stalls the repair process. The Linux kernel maintainers have merged fixes across stable branches to track already-visited inodes and break the loop.
Critical Impact
An attacker or corrupted filesystem image with cyclic next_unlinked pointers can trigger an infinite loop in kernel-mode XFS online repair, resulting in denial of service.
Affected Products
- Linux kernel (XFS filesystem online fsck / xrep_iunlink_resolve_bucket)
- Stable kernel branches referenced in the upstream fix commits
- Systems running XFS with online repair (xfs_scrub) enabled
Discovery Timeline
- 2026-08-26 - CVE-2026-80532 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-80532
Vulnerability Analysis
The XFS filesystem maintains per-AG (allocation group) unlinked inode lists used to track inodes that have been unlinked but remain open. When online fsck runs, xrep_iunlink_resolve_bucket walks these lists to rebuild the incore prev and next pointers from on-disk and in-memory state. This walk trusts the next_unlinked pointer chain to eventually terminate. If the chain contains a cycle, the routine iterates indefinitely without progress. This is an infinite loop denial-of-service condition in kernel context.
Root Cause
The repair function lacked a mechanism to detect previously visited inodes during traversal. Without cycle detection, any next_unlinked pointer that references an earlier node in the walk produces unbounded iteration. The fix introduces a bitmap of seen agino values and checks new pointers against it. If a bit is already set, the code treats the entry as either a loop or an inode with nonzero link count and stops walking that chain.
Attack Vector
Exploitation requires the online repair path to process a filesystem containing cyclic unlinked-list pointers. This can arise from an attacker-supplied crafted XFS image mounted and scrubbed on the target, or from real on-disk corruption. Local privileges sufficient to trigger xfs_scrub on a controlled filesystem are typically needed. Successful triggering pins a kernel thread in a tight loop and blocks progress on the affected AG.
No verified public exploit code is available. Refer to the upstream commits for technical detail: Kernel Git Commit 23690064, Kernel Git Commit 24aec8c8, Kernel Git Commit 6d67c6b9, and Kernel Git Commit b6baf0db.
Detection Methods for CVE-2026-80532
Indicators of Compromise
- A kernel thread executing xrep_iunlink_resolve_bucket consuming 100% CPU for extended periods
- Stalled or hung xfs_scrub processes on mounted XFS filesystems
- Kernel soft-lockup or RCU stall warnings referencing XFS repair symbols in dmesg
Detection Strategies
- Monitor kernel logs for XFS online-repair warnings and soft-lockup traces originating in the XFS repair subsystem
- Track long-running xfs_scrub invocations that fail to complete or make progress
- Compare running kernel versions against the fixed commits listed in the upstream references
Monitoring Recommendations
- Alert on sustained high system CPU time on hosts running XFS online repair
- Collect and review dmesg output for XFS-related stall and lockup messages
- Inventory kernel builds across the fleet to identify hosts missing the upstream fix commits
How to Mitigate CVE-2026-80532
Immediate Actions Required
- Update to a Linux kernel that includes the upstream fix commits 23690064, 24aec8c8, 6d67c6b9, or b6baf0db on the relevant stable branch
- Restrict which users and workloads can mount untrusted XFS images and invoke xfs_scrub
- Suspend automated online repair jobs on hosts pending patch deployment
Patch Information
The upstream fix adds seen-inode tracking to xrep_iunlink_resolve_bucket, terminating traversal when a previously visited agino is encountered. Patched commits are available via the kernel stable tree: 23690064f235, 24aec8c88539, 6d67c6b99f1f, and b6baf0db357f. Distribution vendors will backport these to supported kernel packages; consult vendor advisories for the specific fixed version for your distribution.
Workarounds
- Disable scheduled xfs_scrub execution until the kernel is patched
- Avoid mounting XFS filesystems from untrusted sources on production hosts
- Constrain mount and scrub operations to administrative users only
# Disable scheduled xfs_scrub timers pending patch
systemctl disable --now xfs_scrub_all.timer
systemctl disable --now xfs_scrub@.service
# Verify running kernel version
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
